Scaling vulnerability response from days to minutes across 10+ projects

Problem

Dependency vulnerabilities were being audited and patched one project at a time, manually, whenever someone remembered to check — a process that took days per project and didn’t scale as the number of active services grew past ten. A slow, inconsistent process is itself a risk: the gap between a CVE being published and a fix landing in production is exactly the window an attacker needs.

Solution

I designed and scaled, with AI assistance, a standardized audit-and-mitigation pipeline: dependency auditing (pnpm audit, audit-ci) wired into CI via GitHub Actions and enforced locally through Husky hooks, so a vulnerable dependency gets flagged before it ever reaches a shared branch, not discovered afterward. AI acceleration helped triage findings quickly across projects with different stacks and dependency trees — surfacing what actually needed a fix versus noise — while the decision of what to patch, defer, or accept as a documented risk stayed a human call. The same pattern applied to security controls more broadly: OWASP Top 10 checks (JWT + OTP, 2FA, XSS/CSRF/SQL-injection mitigation, rate limiting) became part of the same standardized rollout instead of a per-project afterthought.

Impact

• Response time for a discovered vulnerability dropped from days to minutes, across 10+ projects running in parallel.
• The process became the company’s standard practice, not a one-off cleanup — every new project inherits it by default.
• It reused the same “AI for mechanical triage, human judgment for the actual risk decision” pattern proven earlier during the Angular v12→v22 modernization, reinforcing it as a repeatable way of adopting AI without sacrificing technical rigor.