Initial Commit

2026-09-15 15:24:03 -04:00
commit 4dc7086e7e
605 changed files with 101380 additions and 0 deletions
@@ -0,0 +1,31 @@
+# `OWUITOOLS_NVD_KEY` — lifts the rate limit on `lookup_cve`
+
+Ten minutes, most of it waiting for an email. Free. **Optional**, and it matters less than
+the other two.
+
+## Why
+
+`lookup_cve` asks CIRCL first, MITRE second, and only goes to NVD for CVSS scoring and CPE
+detail. CIRCL has no hard limit, so most lookups never touch NVD at all. Keyless NVD is
+documented at **5 requests per 30 seconds**, which is only a problem if you lean on the
+score breakdown.
+
+## Steps
+
+1. Go to <https://nvd.nist.gov/developers/request-an-api-key>.
+2. Fill in the form. The key arrives by email, usually within minutes.
+3. Put it in `configs/owuitools.env`:
+
+   ```
+   OWUITOOLS_NVD_KEY=...
+   ```
+
+4. `docker compose up -d api`
+
+## Checking it
+
+```sh
+./tests/try-tool.sh lookup_cve '{"cve_id": "CVE-2014-0160"}' | head -10
+```
+
+You should see a CVSS vector. Without a key you still get the description and references.