Achilles

EUVD — ENISA European Vulnerability Database

Public, unauthenticated. EU-CNA coverage the US-centric feeds miss. Achilles' primary source — on by default.

OSV — Open-source package advisories (npm, crates.io, …)

Public, unauthenticated. Covers Electron, Tauri, React Native, and every bundled npm dependency.

NVD — NIST National Vulnerability Database API key (optional)

Keyed by CPE. Covers runtimes EUVD/OSV don't: Chromium, Node.js, Qt, Flutter, JDK, WebKit, …

GHSA — GitHub Security Advisories Personal access token (required)

Unauth rate limit (60/h) is too low to be useful. A classic PAT with no scopes suffices.

Filtering Hide CVEs older than years (0 = no filter)

Wide-net CPEs (Safari, Java, Qt, Chromium …) otherwise return decades of irrelevant history. Advisories without a publication date are never filtered.

Fleet reporting — periodically report an app inventory to a collector

When on, the app runs in the background (tray) and POSTs an inventory — installed apps, their versions, and detected runtimes — to your collector on a schedule. No CVE data is sent. Off by default.

Collector URL Bearer token Fleet id Reassess every minutes Start at login (run in background)

Trusted VDB host — match CVEs against a downloaded snapshot

Download a vulnerability-database snapshot from a trusted host and match versions locally (offline). Avoids per-device NVD rate limits and leaking queries. Falls back to the public sources when the snapshot is missing or a runtime isn't covered.

Snapshot URL Token (optional) Refresh every minutes