The Pipeline
Every resource on appsec.fyi flows through a fully automated pipeline. No CMS, no framework, no manual HTML editing. Just Python scripts, a SQLite database, and cron jobs.
What Gets Built
The build script runs 20 steps in sequence. Here's what it produces:
- 22 topic pages — one per security topic, each with a sortable resource table, related topics, comparison links, and FAQ structured data
- Recently added — the newest resources across all topics
- Weekly changelog — everything added in the last 7 days, grouped by topic
- Trending topics — ranked by click volume from real visitor engagement data
- Topic graph — an interactive D3.js force-directed visualization of how topics relate to each other
- Glossary — plain-English definitions of 48 appsec terms
- Comparisons About — 15 side-by-side breakdowns of commonly confused concepts
- JSON APIs — 5 public endpoints covering resources, glossary, trending, changelog, and topic graph data. Available upon request.
- RSS feeds — one main feed plus 22 per-topic feeds
- Sitemap — content-hash based so
lastmodonly changes when content actually changes
Automation Schedule
Quality Control
Not everything that gets bookmarked makes it to the site. Several layers of quality control run automatically:
- Deduplication — the same URL can't appear twice under the same topic
- Broken link checker — runs monthly, automatically hides resources that return 404s or connection errors
- Health badges — each topic on the homepage shows whether it's actively updated, stable, or going stale
- Click tracking — anonymous engagement data shows which topics and resources visitors actually find useful, feeding back into the trending system
The Stack
The entire site is static HTML. No React, no Next.js, no Tailwind, no build tools. Pages load in under 200ms. The server runs on a single small VPS with HTTP/2, HTTP/3 (QUIC), and pre-compressed static files.
Why Build It This Way?
Most resource collections are either manually maintained wikis that go stale, or algorithmically generated link farms with no curation. appsec.fyi tries to be neither — human-curated content with automated infrastructure.
The pipeline is designed so that adding a new resource takes seconds (bookmark it), while everything else — summarization, page generation, distribution — happens automatically. The result is a site that stays fresh without requiring daily maintenance.
Built and maintained by Carl Sampson. Questions or ideas? Find me on X or LinkedIn.