The Zero-Dollar Zero-Day Tracker and Alerts with Claude

#!/usr/bin/env bash
set -euo pipefail
OUT_DIR="/Users/xxxxx/Desktop/"
TARGET_FILE="${OUT_DIR}/0day_In_The_Wild.csv"
EXPORT_URL="https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/export?format=csv&gid=1331951416"
mkdir -p "${OUT_DIR}"
curl -sL "${EXPORT_URL}" -o "${TARGET_FILE}"
echo "Synced $(wc -l < "${TARGET_FILE}") lines to ${TARGET_FILE}"

45 15 * * 1-5 /bin/bash -c "Users/xxxxx/Desktop/update_0day_data.sh > /dev/null 2>&1"

Runs once per day. Checks whether any tracked zero-day was patched today, and if so posts a notification to Slack.
Tracker data
/Users/xxxxx/Desktop/0day_In_The_Wild.csv
Slack destination
#your_slack_channel_for_alerting (private channel, ID XXXXXXXXXXX)
CSV columns: CVE, Vendor, Product, Type, Description, Date Discovered, Date Patched, Advisory, Analysis URL, Root Cause Analysis, Reported By.
Steps
1. Find today's rows
Read the CSV and compare each Date Patched value (format YYYY-MM-DD) against today's date.
No match → stop. Do not post to Slack. Report: date checked, row count scanned, and the most recent Date Patched in the file. This is the normal outcome most days.
One or more matches → continue. Handle every matching row; post one message per row.
2. Pull the row data
Take CVE, Vendor, Product, Type, Description, Reported By, and Advisory from the matching row.
3. Fill the gaps the CSV doesn't cover
The template asks for CVSS score, affected/patched versions, exploitability, and remediation guidance. None of these are in the CSV. Get them from the vendor advisory URL in the Advisory column, and from the CISA KEV catalog if the CVE is listed there.
Handle missing or placeholder data explicitly:
CVE blank → look it up in the vendor advisory. If still not found, use Not yet assigned and say so in the message.
??? in any field → treat as unknown. Never present ??? in the Slack message.
CVSS not published → write Not yet scored rather than estimating one.
Severity wording (HIGH, CRITICAL) → take from the vendor or CISA, not from your own judgment.
Never carry values over from a previous run's message or from pre-filled example text in the template. The template's example content is formatting reference only — do not reuse its CVE, versions, or dates.
4. Post to Slack
Use the template:
Subject line — Zero-Day Notification — [CVE] — [Vendor] [Product] [Type] (Exploited in the Wild)
Bottom Line Up Front — one or two sentences: severity, affected product, source
Vulnerability Details — CVE ID, CVSS score, then the technical description
Affected Versions — table: Software / Component | Affected versions | Patched version
Exploitability — Attack Vector, Authentication Required, Attack Complexity, Known Exploits in the Wild
Solution — patch versions, restart requirements, downstream products, any CISA KEV deadline
References — Vendor, Product, Type, Reported by, Advisory link, Date Patched
Formatting rules:
Use standard Markdown — *bold**, ## headers, [text](url), and pipe-delimited tables. The Slack tool converts this; do not hand-write Slack mrkdwn (bold*, <url|text>).
Slack has no underline. Where the template underlines a field label, render it bold instead.
Add one relevant emoji to each section header — for example 🚨 Bottom Line Up Front, 🔍 Vulnerability Details, 📦 Affected Versions, 💥 Exploitability, 🛠️ Solution, 🔗 References. One per header, none inside body text.
Bold every field label (*CVE ID:**, *Attack Vector:**).
Link the advisory rather than pasting the raw URL.
5. Verify and report
After posting, confirm:
Every field in the message traces to the CSV row, the vendor advisory, or CISA — nothing invented, nothing left as ??? or a template placeholder
The CVE in the message matches the CVE in the matched row
Dates in the message match Date Patched
Then report: the date checked, the CVE(s) posted, the Slack message link, and any field where data was unavailable or assumed.
Guardrails
Post to Slack only when a Date Patched value equals today's date. Do not post near-misses or the most recent entry as a substitute.
One message per matching row. Do not re-post a CVE already sent.
If the CSV is missing, unreadable, or empty, report that and post nothing