PatchHound Engineering Overhaul: Replaces Per-CVE NVD API Calls with Bulk Sync, Eliminating HTTP Delays
The PatchHound vulnerability management platform has undergone a significant backend engineering shift, moving away from inefficient per-CVE API lookups to a high-performance bulk synchronization model. This architectural change introduces a local PostgreSQL cache for the National Vulnerability Database (NVD) feed, allowing the core `NvdVulnerabilityEnrichmentRunner` to read data with zero HTTP delay, dramatically accelerating vulnerability enrichment jobs.
The implementation centers on two new services. The `NvdFeedSyncService` now handles bulk data fetching directly from the NVD API 2.0 endpoint, paginating results at 2,000 CVEs per page. An API key, sourced from OpenBao, is optional but critical for performance: requests without a key incur a 7-second inter-page delay, while authenticated calls reduce this to 700 milliseconds. A dedicated `NvdFeedSyncWorker` runs as a `BackgroundService`, performing an initial sync of the last five years of CVE data on startup and then executing a modified-feed sync every 12 hours to keep the local cache current.
This overhaul fundamentally changes the platform's operational resilience and speed. By decoupling from the NVD's rate-limited public API for real-time queries, PatchHound insulates its core enrichment pipeline from external latency and potential downtime. The move to a scheduled bulk sync model represents a strategic engineering decision to prioritize system reliability and performance, with the optional API key serving as a clear performance gate. The update also includes quality-of-life improvements, such as making admin source rows fully clickable for direct editor access.