vulnerscom/vulncast

VulnCast is firmware for a small desk gadget, built around a roughly 40 dollar ESP32-S3 microcontroller board with an e-paper screen, that turns live security news into something you can glance at instead of chasing notifications. It pulls data directly from the Vulners API, a service that tracks CVEs, which are published records of software security flaws, along with exploit reports, bug bounty updates, and general infosec news, and shows them on the device's screen. Everything runs on the device itself. There is no separate backend server or companion app required. The screen shows a dashboard with rotating channels for news, exploits, bug bounties, and vulnerabilities, and you can add your own custom channels by writing a search query. Each individual record, whether it is a CVE, an exploit, or an advisory, gets its own detail view with severity information broken into plain icons, an impact summary, and a QR code you can scan to open the full report on your phone. The device has a touchscreen for navigating menus, setting up Wi-Fi, and adjusting settings like refresh timing and time zone, and it includes a lighter hearted screensaver mode with simple animated art that appears after the display has been idle. Setting up Wi-Fi does not require a computer: the device can create its own temporary network so you can enter your home Wi-Fi details through a web page, and it remembers multiple networks in case one becomes unavailable. The e-paper screen only redraws the parts of the image that changed, which avoids the flicker you would normally see on a full-screen refresh, while still doing an occasional full refresh to prevent ghosting artifacts building up on the display. The firmware checks for updates from GitHub roughly once an hour, and before installing anything it verifies a cryptographic signature on the update file, so a compromised download source alone could not push unauthorized firmware onto the device. If a newly installed update fails to start up properly, the device automatically reverts back to the previous working version on its own. Building and flashing the firmware yourself uses the PlatformIO toolchain, though the project also offers a browser based flashing page that needs no separate software installed. The project is released under the MIT license, a permissive license that allows free use including commercially.