vulnersCom/VulnCast
Feels like 9.8. The internet's security forecast on your desk — a ~$40 ESP32-S3 e-paper gadget for live Vulners CVE / exploit / bug-bounty / news feeds. - vulnersCom/VulnCast
8 stars · 0 forks · C
README
⚡ VulnCast Feels like 9.8. The internet's security forecast on your desk. A ~$40 ESP32-S3 e-paper gadget that pulls live CVE / exploit / bug-bounty / infosec-news feeds straight from the Vulners API and forecasts the threat "weather" — so you can stop refreshing notifications, mail, and JSON for vulnerability alerts. It watches, so you don't have to. Fully on-device. No backend, no server.
The dashboard: a featured champion + candidate feed, with sync age, API status, and the live web-interface IP in the top bar.
⚡ Flash it in your browser → No build, no esptool — grab the board, click once, done.
✨ Highlights
🛰️ Direct-to-API, on-device. Per-channel Lucene search + on-demand by-id detail, straight from firmware with an X-Api-Key header. No proxy, no companion app. 📡 Rotating channels. News · Exploits · Bug Bounty · Vulnerabilities out of the box — plus any custom channel (just a Lucene query + refresh interval). 🧬 Human-first document view. CVSS decoded into exploitability icons + C/I/A impact bars, CWE / CISA-KEV chips, an exploit count, a scrollable summary, and a scannable QR deep-link — the layout adapts per record type (CVE vs exploit vs advisory). 🖥️ 9-screen touch UI. Dashboard, document, settings, on-screen keyboard, refresh-interval and time-zone pickers — GT911 capacitive touch, saved to NVS. 📶 Zero-config Wi-Fi. WPA2/WPA3, multi-network store, captive-portal provisioning, and a runtime fallback to the setup AP if the network disappears. 🎞️ Flash-free e-paper. A damage-tracking compositor repaints only the changed rows (2-bit partial update) — no full-screen blink on every tick.
📸 Screens
Dashboard CVE document — CVSS vector + C/I/A bars Exploit document — archetype-adaptive Settings — Wi-Fi, feeds, time zone On-screen keyboard Time-zone picker Captive-portal setup Connecting
→ Full gallery (all 9 screens)
🛠 Hardware
Board: LilyGo T5 4.7" E-Paper S3 V2.4 (ESP32-S3-WROOM-1-N16R8 — 16 MB flash, 8 MB OPI PSRAM, 240 MHz, dual-app OTA partitions). ~$40 — pick the Touch variant. Panel: 960×540 ED047TC1 e-paper (rendered 2-bit) with a GT911 capacitive touch controller. ESP32-S3 is 2.4 GHz Wi-Fi only. Native USB may re-enumerate on reset — that is normal.
🧩 Software stack (fully on-device, no backend)
Platform: pioarduino — Arduino-ESP32 3.x / ESP-IDF 5.5. Display: FastEPD drives the V2.4 shift-register panel; epdiy 2.0 is the software rasterizer. A 960×540 4bpp framebuffer lives in PSRAM; a damage-tracking compositor repaints only the changed rows (flash-free 2-bit partial update) — a full flash runs only on a page/data change and a periodic de-ghost. Data: the Vulners REST API over HTTPS, parsed with ArduinoJson filters using precise dot-notation field selection, so even multi-MB documents stay small. Wi-Fi: WPA2/WPA3, multi-network NVS store, captive-portal provisioning (vulncast.local). Update: USB and password-protected OTA (ArduinoOTA).
⚡ Flash it — no build required The easiest path: flash from your browser →. Plug the board in over USB-C, click once, and ESP Web Tools writes the firmware over Web Serial — no toolchain, no compiler. Needs desktop Chrome / Edge / Opera. The flasher (page + manifest + firmware) is self-hosted from this repo under flasher/ and published to GitHub Pages. The shipped binary is credential-free — you enter Wi-Fi and your Vulners API key on the device via the captive portal; nothing is baked in. Prefer the CLI? Flash the same image with esptool: esptool.py --chip esp32s3 write_flash 0x0 flasher/firmware/vulncast-1.0.3-esp32s3.factory.bin Verify the image first — SHA-256 of vulncast-1.0.3-esp32s3.factory.bin: e2d7f6792ae2dd00db5cb9e20ff1c56b7202643767a657d55944546b45d3db75
🚀 Build & flash (from source) Requires PlatformIO Core (≥ 6.1.18) and a Vulners API key. cp secrets.yaml.example secrets.yaml # fill vulners_api_key (+ optional wifi seed / ota_password) pio run # compile (generates include/secrets.h from secrets.yaml) pio run -t upload # flash over USB pio device monitor # serial logs @115200 On first boot with no known Wi-Fi in range, the device raises a VulnCast-Setup hotspot — join it, open http://192.168.4.1, pick your network and enter your API key. Everything (Wi-Fi, key, channels, time zone) is stored in NVS; secrets.yaml only seeds a first-boot fallback and is never committed. 🔌 Debug console An always-on UART console runs on its own core-0 task (it answers even if the UI loop is busy). Drive it from the host with tools/console.py (pip install pyserial pillow): python tools/console.py info # device state (wifi, api key, channels, heap) python tools/console.py dump fb.png # capture the exact e-paper framebuffer as a PNG python tools/console.py press featured # inject a touch at a named hit-box python tools/console.py reboot 📂 Repository layout
Path What
src/ Firmware: orchestration, 9-screen UI + touch, drawing toolkit, Vulners client, channels, Wi-Fi, timekeeper, config, web UI.
boards/T5-ePaper-S3.json Board definition (vendored from LilyGo) for the exact V2.4 module.
scripts/gen_secrets.py Pre-build hook: generates include/secrets.h from secrets.yaml.
tools/ Host tooling: serial console, framebuffer dump, font/asset generation.
🤝 Contributing & security
Contributor guide → CONTRIBUTING.md Security policy & reporting → SECURITY.md
🙏 Credits Fonts: JetBrains Mono (OFL 1.1). Libraries: FastEPD · epdiy · ArduinoJson · SensorLib · Button2 · QRCode. Full attribution in THIRD_PARTY_NOTICES.md. A Vulners Inc. project, powered by the Vulners API. Not affiliated with or endorsed by LilyGo. 📜 License MIT © 2026 Vulners Inc.
Built with ⚡ by Vulners
#ESP32 #ESP32S3 #ePaper #eInk #LilyGo #PlatformIO #Arduino #Vulners #CyberSecurity #InfoSec #VulnerabilityManagement #CVE #ThreatIntel #IoT #EmbeddedSystems #DevSecOps