Achilles

EUVD — ENISA European Vulnerability Database

Public, unauthenticated. EU-CNA coverage the US-centric feeds miss. Achilles' primary source — on by default.

OSV — Open-source package advisories (npm, crates.io, …)

Public, unauthenticated. Covers Electron, Tauri, React Native, and every bundled npm dependency.

NVD — NIST National Vulnerability Database API key (optional)

Keyed by CPE. Covers runtimes EUVD/OSV don't: Chromium, Node.js, Qt, Flutter, JDK, WebKit, …

GHSA — GitHub Security Advisories Personal access token (required)

Unauth rate limit (60/h) is too low to be useful. A classic PAT with no scopes suffices.

Filtering Hide CVEs older than years (0 = no filter)

Wide-net CPEs (Safari, Java, Qt, Chromium …) otherwise return decades of irrelevant history. Advisories without a publication date are never filtered.