Inspiration
Hospitals run dense vendor stacks: EHRs, portals, interfaces, imaging, and almost none of that is visible from the outside without either proprietary threat intel or unauthorized scanning. Public filings already say a lot: Medicare attestation ties facilities to certified products, the HHS OCR portal names breached covered entities, CISA publishes what is being exploited, and SEC 8-K Item 1.05 disclosures force material cyber incidents into the open. TigerHacks’ health theme was a chance to build a product that existed in that gap: attack-surface and third-party risk for hospitals, grounded only in citable public record, closer in spirit to BitSight or Claroty than to a vulnerability scanner.
The hard line from project start was ethical and legal. Evidence of exploitability (CVSS, EPSS, KEV, confirmed exposure) is useful. Exploit code, live probing of hospital networks, and attack surface identification are not allowed without explicit, written permission.
What it does
VulnRx loads Medicare-registered U.S. hospitals, joins them to certified health IT products when CMS/ONC/CHPL already make that join, and layers on breaches, SEC cyber disclosures, CVEs, KEV status, and passively indexed exposure: each link only when the upstream record names the entities involved. The UI is a dark map of the country (breach density by state, green dots for hospitals with a catalog-linked CVE), hospital and vendor profiles with provenance, a rollup score that averages only the inputs that actually exist, and on-click Gemini briefings that explain a CVE, answer a records question, or draft remediation from stored facts alone.
How I built it
Three Rust crates on Postgres 16 / TimescaleDB:
- vulnrx-models — migrations and shared types
- vulnrx-etl — ingest pipelines for CMS hospitals, promoting-interoperability / CEHRT, HHS OCR breaches, CISA KEV, NVD and the CVE List, CISA CSAF advisories, FDA safety communications, SEC EDGAR, and optional exposure indexes (ZoomEye, Netlas, with crt.sh + Shodan InternetDB as a free fallback)
- vulnrx-api — Axum + Askama + HTMX: landing page, map dashboard, hospital/vendor/KEV pages, search, ask, explain, and remediate
Scoring writes a hospital rollup only when at least one of breach, Item 1.05, product CVE, or exposure is linked. Unused components are stored as zero and excluded from the average; the method string names what went in. Gemini (gemini-3.5-flash-lite) is gated to one short call per click, with replies persisted so the same hospital or CVE is not billed twice.
What I learned
Exact-match provenance is slower than fuzzy “looks like” linking. Name normalization that is careful enough to avoid false hospital breach pairs also leaves ambiguous OCR rows unlinked is the way to fly. Product to CVE matching is even stricter: NVD and the CVE List often catalog open-source or device names (Mirth Connect, eClinicalWorks) while the certified brand in CHPL is EpicCare or MEDITECH Expanse.
I also learned how much of “internet exposure for healthcare” sits behind paid search APIs. Free ZoomEye/Netlas quotas and certificate fallbacks exist, but Shodan/Censys-style coverage is a paywall, not a weekend ETL gap.
Challenges
- Entity resolution without fiction. OCR covered-entity names and hospital legal names diverge. VulnRx requires a unique normalized name+state match; everything else stays out.
- CEHRT bundle expansion. 2024 CMS ids need CHPL lookups; many 404. A
--missingretry path exists, but unlinked ids stay unlinked. - EDGAR SIC filtering. Sticky empty result pages looked like successful matches until cache keys and end dates were forced unique per attempt.
- Exposure without scanning. No active probes, no stored host addresses, and a fallback that only stores when one certificate names one hospital and one CPE names one already-linked product—yielding few confirming hits and many timeouts.
- AI that cannot freestyle. Ask / Explain / Remediate receive short fact lines only. If the store cannot name a hospital or CVE, there is no model call. I wanted to originally have the LLM generating relevant exploits/POCs for CVEs on the fly too, but I decided against this since I don't want any federal agents knocking on my door. More than they already do, anyway.
Built with
Rust, Axum, Askama, HTMX, Postgres, TimescaleDB, CMS / ONC / CHPL, HHS OCR, CISA KEV & CSAF, NVD, CVE List, FDA, SEC EDGAR, Gemini 3.5 Flash-Lite.
Log in or sign up for Devpost to join the conversation.