security-screening

Nine services on https://fittings.sh covering two jobs that look unrelated and are not: deciding whether a vulnerability is worth acting on, and deciding whether a counterparty is one you are allowed to deal with. Both fail the same way. The answer sounds authoritative when recalled from weights, and it is wrong on exactly the cases that matter — the CVE that entered CISA's catalog last Tuesday, the entity added to a sanctions list last week.

Live catalog for this slice: https://fittings.sh/catalog?category=Security. Browsing it, searching it and reading any schema cost nothing.

When to reach for this

When you hold a vulnerability identifier and have to say something about it that a user will act on: patch now, patch this sprint, or ignore. When you have a product or a version and no identifier yet. When you are running a weekly check for newly exploited vulnerabilities. And when a workflow is about to onboard, pay, contract with or ship to a named party, and someone has to look at the restricted party lists first.