Vulnerabilities hub: NVD ingestion
Source verification:
0da1a3c784, 2026-10-04 (PCD-283). This replaces the retired Concelier NVD procedure. Its dated original is preserved verbatim as historical evidence. No live upstream or deployment was probed for this documentation change.
Start with hub ingestion operations. The current source key is nvd; the worker’s configured source list controls whether it runs.
stella sources status --json
Inspect the nvd generation, health, documents seen/new/quarantined and last completion. Correlate it with the worker’s source outcome. The current connector fetches and parses NVD records inside the hub cycle; the retired three-job procedure does not apply.
Configuration to inspect
AddVulnerabilitiesIngestScheduling binds NvdSourceOptions at Vulnerabilities:Ingestion:Sources:Nvd:
| Option | Meaning |
|---|---|
BaseEndpoint | NVD-compatible CVE endpoint selected for the installation. |
ApiKey | Optional API key. Keep its value in approved secret/configuration handling and out of reports. |
ResultsPerPage | Requested page size; default 2000. |
WindowOverlap | Overlap when advancing a delta window; default five minutes. |
PageDelay | Pause between page requests; default six seconds. |
These are current option names, not instructions to copy a retired Concelier configuration. Check endpoint availability, rejected requests and throttling in sanitized worker evidence. Do not disable transport or integrity controls to conceal an upstream failure. Apply a confirmed configuration correction through the owning deployment procedure, then follow recovery verification.
Re-verify
Read src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Ingestion/Connectors/NvdSourceConnector.cs and the binding in its parent ServiceCollectionExtensions.cs. The common operations page lists the owner routes and the executable CLI documentation check. Source verification establishes the contract; a recovered feed needs a newly observed generation and input evidence.
Source check: git show HEAD:src/Vulnerabilities/__Libraries/StellaOps.Vulnerabilities.Ingestion/Connectors/NvdSourceConnector.cs.