# 3d74r08/vulntrack architecture

> Architecture diagram of the GitHub repository 3d74r08/vulntrack, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/3d74r08/vulntrack
- Repository: https://github.com/3d74r08/vulntrack

## Overview

VulnTrack is a multi-tenant vulnerability-management platform. Its main workflow registers assets, records or imports findings, enriches CVEs with NVD data, evaluates risk, and manages remediation through monitored SLAs. The React client calls an Express API; PostgreSQL RLS isolates tenant data, while a separate worker handles scheduled checks and enrichment. The README also documents a scanner and Redis, but sampled source does not establish their internal request or storage wiring, so those links are shown only where explicitly documented. Several less-sampled API areas are grouped by their existing directories.

Main entry points: [`backend/src/server.js`](https://github.com/3d74r08/vulntrack/blob/main/backend/src/server.js) (Express API), [`backend/src/services/vulnerabilidadService.js`](https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/vulnerabilidadService.js) (Vulnerability lifecycle), [`frontend/src/Dashboard.jsx`](https://github.com/3d74r08/vulntrack/blob/main/frontend/src/Dashboard.jsx) (Dashboard views), [`backend/src/services/riesgoService.js`](https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/riesgoService.js) (Risk evaluation)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["User interface"]
  node_spa["React application<br/>[App.jsx]"]
  node_dashboard["Dashboard views<br/>[Dashboard.jsx]"]
  node_assetview["Asset inventory<br/>[ActivosView.jsx]"]
  node_vulnview["Vulnerability views"]
  node_remview["Remediation views"]
  node_otherviews["Supporting views"]
  node_apiclient["API client<br/>[apiClient.js]"]
end

subgraph group_api["API and security"]
  node_api["Express API<br/>[server.js]"]
  node_auth["Authentication<br/>[authController.js]"]
  node_authorization["Token and RBAC<br/>[roleMiddleware.js]"]
  node_otherapi["Admin and reporting"]
end

subgraph group_domain["Vulnerability workflow"]
  node_assets["Asset management"]
  node_findings["Finding intake"]
  node_imports["Bulk import"]
  node_vulnservice["Vulnerability lifecycle"]
  node_nvd["NVD enrichment<br/>[nvdService.js]"]
  node_risk["Risk evaluation<br/>[riesgoService.js]"]
  node_remediation["Remediation plans"]
  node_remservice["Plan automation"]
end

subgraph group_operations["Background operations"]
  node_worker["Scheduled worker<br/>[slaWorker.js]"]
  node_scanner["Scanner process<br/>[index.js]"]
end

subgraph group_infra["Data and integrations"]
  node_dbaccess["Tenant DB access<br/>[db.js]"]
  node_postgres[("PostgreSQL + RLS")]
  node_redis[("Redis")]
  node_nvdapi["NVD / NIST"]
  node_email["Email service"]
end

node_user(("User / browser"))

node_user -->|"uses"| node_spa
node_spa -->|"renders"| node_dashboard
node_dashboard -->|"renders"| node_assetview
node_dashboard -->|"renders"| node_vulnview
node_dashboard -->|"renders"| node_remview
node_dashboard -->|"renders"| node_otherviews
node_assetview -->|"requests data"| node_apiclient
node_vulnview -->|"requests data"| node_apiclient
node_remview -.->|"requests data"| node_apiclient
node_apiclient -->|"calls REST"| node_api
node_scanner -->|"calls API"| node_api
node_api -->|"routes auth"| node_auth
node_api -->|"routes assets"| node_assets
node_api -->|"routes findings"| node_findings
node_api -->|"routes imports"| node_imports
node_api -->|"routes plans"| node_remediation
node_api -->|"routes other areas"| node_otherapi
node_api -->|"protects routes"| node_authorization
node_findings -->|"creates findings"| node_vulnservice
node_findings -->|"looks up CVEs"| node_nvd
node_findings -->|"evaluates risk"| node_risk
node_imports -->|"looks up CVEs"| node_nvd
node_imports -->|"creates findings"| node_vulnservice
node_vulnservice -->|"enriches CVE"| node_nvd
node_vulnservice -->|"evaluates risk"| node_risk
node_risk -->|"creates plans"| node_remservice
node_remediation -->|"updates status"| node_vulnservice
node_remediation -->|"manages plans"| node_remservice
node_assets -->|"queries tenant data"| node_dbaccess
node_vulnservice -->|"reads and writes"| node_dbaccess
node_risk -->|"stores evaluations"| node_dbaccess
node_remservice -->|"stores plans"| node_dbaccess
node_dbaccess -->|"queries with RLS"| node_postgres
node_api -.->|"login rate limit"| node_redis
node_worker -->|"checks SLA data"| node_postgres
node_worker -->|"enriches CVEs"| node_nvd
node_worker -->|"sends alerts"| node_email
node_worker -->|"reevaluates risk"| node_risk
node_nvd -.->|"queries source"| node_nvdapi

click node_spa "https://github.com/3d74r08/vulntrack/blob/main/frontend/src/App.jsx"
click node_dashboard "https://github.com/3d74r08/vulntrack/blob/main/frontend/src/Dashboard.jsx"
click node_assetview "https://github.com/3d74r08/vulntrack/blob/main/frontend/src/views/ActivosView.jsx"
click node_vulnview "https://github.com/3d74r08/vulntrack/blob/main/frontend/src/views/VulnerabilidadesView.jsx"
click node_remview "https://github.com/3d74r08/vulntrack/blob/main/frontend/src/views/RemediacionesView.jsx"
click node_otherviews "https://github.com/3d74r08/vulntrack/tree/main/frontend/src/views"
click node_apiclient "https://github.com/3d74r08/vulntrack/blob/main/frontend/src/utils/apiClient.js"
click node_api "https://github.com/3d74r08/vulntrack/blob/main/backend/src/server.js"
click node_auth "https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/authController.js"
click node_authorization "https://github.com/3d74r08/vulntrack/blob/main/backend/src/middlewares/roleMiddleware.js"
click node_assets "https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/activosController.js"
click node_findings "https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/hallazgosController.js"
click node_imports "https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/importacionController.js"
click node_vulnservice "https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/vulnerabilidadService.js"
click node_nvd "https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/nvdService.js"
click node_risk "https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/riesgoService.js"
click node_remediation "https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/remediacionController.js"
click node_remservice "https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/remediacionService.js"
click node_otherapi "https://github.com/3d74r08/vulntrack/tree/main/backend/src/controllers"
click node_worker "https://github.com/3d74r08/vulntrack/blob/main/backend/src/workers/slaWorker.js"
click node_scanner "https://github.com/3d74r08/vulntrack/blob/main/scanner/src/index.js"
click node_dbaccess "https://github.com/3d74r08/vulntrack/blob/main/backend/src/config/db.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_spa,node_dashboard,node_assetview,node_vulnview,node_remview,node_otherviews,node_apiclient,node_user toneBlue
class node_api,node_auth,node_authorization,node_otherapi toneAmber
class node_assets,node_findings,node_imports,node_vulnservice,node_nvd,node_risk,node_remediation,node_remservice toneMint
class node_worker,node_scanner toneRose
class node_dbaccess,node_postgres,node_redis,node_nvdapi,node_email toneIndigo
```

## Components

### User interface

- [React application](https://github.com/3d74r08/vulntrack/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [Dashboard views](https://github.com/3d74r08/vulntrack/blob/main/frontend/src/Dashboard.jsx): `frontend/src/Dashboard.jsx`
- [Asset inventory](https://github.com/3d74r08/vulntrack/blob/main/frontend/src/views/ActivosView.jsx): `frontend/src/views/ActivosView.jsx`
- [Vulnerability views](https://github.com/3d74r08/vulntrack/blob/main/frontend/src/views/VulnerabilidadesView.jsx): `frontend/src/views/VulnerabilidadesView.jsx`
- [Remediation views](https://github.com/3d74r08/vulntrack/blob/main/frontend/src/views/RemediacionesView.jsx): `frontend/src/views/RemediacionesView.jsx`
- [Supporting views](https://github.com/3d74r08/vulntrack/tree/main/frontend/src/views): `frontend/src/views`
- [API client](https://github.com/3d74r08/vulntrack/blob/main/frontend/src/utils/apiClient.js): `frontend/src/utils/apiClient.js`

### API and security

- [Express API](https://github.com/3d74r08/vulntrack/blob/main/backend/src/server.js): `backend/src/server.js`
- [Authentication](https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/authController.js): `backend/src/controllers/authController.js`
- [Token and RBAC](https://github.com/3d74r08/vulntrack/blob/main/backend/src/middlewares/roleMiddleware.js): `backend/src/middlewares/roleMiddleware.js`
- [Admin and reporting](https://github.com/3d74r08/vulntrack/tree/main/backend/src/controllers): `backend/src/controllers`

### Vulnerability workflow

- [Asset management](https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/activosController.js): `backend/src/controllers/activosController.js`
- [Finding intake](https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/hallazgosController.js): `backend/src/controllers/hallazgosController.js`
- [Bulk import](https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/importacionController.js): `backend/src/controllers/importacionController.js`
- [Vulnerability lifecycle](https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/vulnerabilidadService.js): `backend/src/services/vulnerabilidadService.js`
- [NVD enrichment](https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/nvdService.js): `backend/src/services/nvdService.js`
- [Risk evaluation](https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/riesgoService.js): `backend/src/services/riesgoService.js`
- [Remediation plans](https://github.com/3d74r08/vulntrack/blob/main/backend/src/controllers/remediacionController.js): `backend/src/controllers/remediacionController.js`
- [Plan automation](https://github.com/3d74r08/vulntrack/blob/main/backend/src/services/remediacionService.js): `backend/src/services/remediacionService.js`

### Background operations

- [Scheduled worker](https://github.com/3d74r08/vulntrack/blob/main/backend/src/workers/slaWorker.js): `backend/src/workers/slaWorker.js`
- [Scanner process](https://github.com/3d74r08/vulntrack/blob/main/scanner/src/index.js): `scanner/src/index.js`

### Data and integrations

- [Tenant DB access](https://github.com/3d74r08/vulntrack/blob/main/backend/src/config/db.js): `backend/src/config/db.js`
- **PostgreSQL + RLS**
- **Redis**
- **NVD / NIST**
- **Email service**

### Other components

- **User / browser**

## Connections

- User / browser → React application: uses
- React application → Dashboard views: renders (evidence: `frontend/src/App.jsx`)
- Dashboard views → Asset inventory: renders (evidence: `frontend/src/Dashboard.jsx`)
- Dashboard views → Vulnerability views: renders (evidence: `frontend/src/Dashboard.jsx`)
- Dashboard views → Remediation views: renders (evidence: `frontend/src/Dashboard.jsx`)
- Dashboard views → Supporting views: renders (evidence: `frontend/src/Dashboard.jsx`)
- Asset inventory → API client: requests data (evidence: `frontend/src/views/ActivosView.jsx`)
- Vulnerability views → API client: requests data (evidence: `frontend/src/views/VulnerabilidadesView.jsx`)
- Remediation views → API client: requests data
- API client → Express API: calls REST
- Scanner process → Express API: calls API
- Express API → Authentication: routes auth (evidence: `backend/src/server.js`)
- Express API → Asset management: routes assets (evidence: `backend/src/server.js`)
- Express API → Finding intake: routes findings (evidence: `backend/src/server.js`)
- Express API → Bulk import: routes imports (evidence: `backend/src/server.js`)
- Express API → Remediation plans: routes plans (evidence: `backend/src/server.js`)
- Express API → Admin and reporting: routes other areas (evidence: `backend/src/server.js`)
- Express API → Token and RBAC: protects routes
- Finding intake → Vulnerability lifecycle: creates findings (evidence: `backend/src/controllers/hallazgosController.js`)
- Finding intake → NVD enrichment: looks up CVEs (evidence: `backend/src/controllers/hallazgosController.js`)
- Finding intake → Risk evaluation: evaluates risk (evidence: `backend/src/controllers/hallazgosController.js`)
- Bulk import → NVD enrichment: looks up CVEs (evidence: `backend/src/controllers/importacionController.js`)
- Bulk import → Vulnerability lifecycle: creates findings (evidence: `backend/src/controllers/importacionController.js`)
- Vulnerability lifecycle → NVD enrichment: enriches CVE (evidence: `backend/src/services/vulnerabilidadService.js`)
- Vulnerability lifecycle → Risk evaluation: evaluates risk (evidence: `backend/src/services/vulnerabilidadService.js`)
- Risk evaluation → Plan automation: creates plans (evidence: `backend/src/services/riesgoService.js`)
- Remediation plans → Vulnerability lifecycle: updates status (evidence: `backend/src/controllers/remediacionController.js`)
- Remediation plans → Plan automation: manages plans (evidence: `backend/src/controllers/remediacionController.js`)
- Asset management → Tenant DB access: queries tenant data (evidence: `backend/src/controllers/activosController.js`)
- Vulnerability lifecycle → Tenant DB access: reads and writes (evidence: `backend/src/services/vulnerabilidadService.js`)
- Risk evaluation → Tenant DB access: stores evaluations (evidence: `backend/src/services/riesgoService.js`)
- Plan automation → Tenant DB access: stores plans (evidence: `backend/src/services/remediacionService.js`)
- Tenant DB access → PostgreSQL + RLS: queries with RLS (evidence: `backend/src/config/db.js`)
- Express API → Redis: login rate limit
- Scheduled worker → PostgreSQL + RLS: checks SLA data
- Scheduled worker → NVD enrichment: enriches CVEs (evidence: `backend/src/workers/slaWorker.js`)
- Scheduled worker → Email service: sends alerts (evidence: `backend/src/workers/slaWorker.js`)
- Scheduled worker → Risk evaluation: reevaluates risk (evidence: `backend/src/workers/slaWorker.js`)
- NVD enrichment → NVD / NIST: queries source