watchDog

watchDog walks a network assessment the way a pentester would: discover the network, discover hosts, enumerate services, fingerprint them, correlate against vulnerability intelligence, prioritise - then you decide, and it runs safe verification. The core principle is to automate the repetitive work while keeping the human in control of the decisions that matter.

The architecture splits the work deliberately. The phone does 100% of network I/O; the backend never connects to a target - it's a pure brain doing correlation, prioritisation, the vuln database, and serving signed check-definitions the phone runs locally. That split eliminates backend SSRF by construction rather than by filtering.

The hard part of the domain is false positives, so the correlation engine is built to suppress them: it's CVE-List-first rather than NVD-first, and it runs a real dpkg version comparator so a banner like OpenSSH_8.2p1 Ubuntu-4ubuntu0.11 is correctly judged patched by the distro backport even though upstream 8.2p1 looks vulnerable. Version-only matches never rank above 'likely', CVSS is chosen by provenance and never averaged, and KEV plus EPSS drive prioritisation so range-match noise doesn't drown the signal.