A blue team news desk that lives in your VS Code sidebar.
Ten security feeds, aggregated into one scrollable card feed, with an anchor-style briefing at the top summarising what happened while you were asleep. Built for the analyst who opens the editor before they open a browser.
Nuusbrief is Afrikaans for "news bulletin".
What it does
A briefing, not just a list. Press Generate briefing and the extension writes you a short bulletin: a lead story, a handful of themed bullets, anything that hit your watchlist, and one concrete thing to check today.
A watchlist that finds your estate. Add the vendors and products you actually run. Matching stories get an accent rail, a chip naming the term, and a lift to the top of the feed until you have read them. Optionally, a notification when a new one lands.
Read state that survives. Read, unread and bookmarked are tracked per article and persist across workspaces and restarts. The feed dims what you have already seen instead of showing you the same wall every morning.
Handover-ready export. Any article copies out as a Markdown blurb — title, link, source, ISO date, summary — ready to paste into a ticket or a shift note.
Requirements
The feed works on its own with no setup.
The briefing uses VS Code's Language Model API, which runs on your existing GitHub Copilot subscription. There is no API key to obtain, paste or store — and no key for this extension to leak. If Copilot is not installed, the briefing button explains that and everything else keeps working.
The first briefing triggers a one-time VS Code consent prompt.
Sources and categories
134 feeds ship with the extension, in six categories. Only the ten news and
advisory sources are enabled by default, so the first refresh is quick and the
feed stays readable. The rest are one enabled: true away in settings.
| Category | Feeds | What's in it |
|---|---|---|
| News & Advisories | 15 | CISA, BleepingComputer, The Hacker News, Krebs, SANS ISC, The Record, Schneier |
| Vendor Research | 50 | Unit 42, watchTowr, Quarkslab, PT SWARM, TrustedSec, NVISO, Cloudflare, Google Online Security |
| Offensive Research | 25 | dirkjanm.io, Rasta Mouse, SpecterOps, LuemmelSec, VoidSec, X-C3LL |
| Malware & Reversing | 24 | cocomelonc, secret club, theevilbit, Orange Tsai, evilsocket, Reversemode |
| DFIR & Detection | 11 | Didier Stevens, Hexacorn, dfir.ch, Pepe Berba, Nightwatch |
| Cloud & AppSec | 9 | Wiz, Almost Secure, Decoder, Adnan Khan, Laurence Tennant |
A category chip row appears under the filters as soon as more than one category has articles, showing live counts. Chips come from your settings, so inventing your own category is just a matter of typing it — no chip list to maintain.
gertnuusbrief.sources takes any RSS 2.0, Atom or RDF feed. enabled: false
mutes a source without losing its URL, and category groups it.
Each source contributes at most its 50 newest articles per refresh, so one blog that serves its whole archive cannot crowd out everything else.
Settings
| Setting | Default | What it does |
|---|---|---|
gertnuusbrief.sources |
10 feeds | Which feeds to aggregate |
gertnuusbrief.watchlist |
[] |
Terms to highlight and boost |
gertnuusbrief.notifyOnWatchlistHit |
false |
Notify when a new match arrives |
gertnuusbrief.refreshIntervalMinutes |
30 |
Background refresh; 0 for manual only |
gertnuusbrief.maxArticles |
500 |
Cache size |
gertnuusbrief.showImages |
false |
Load feed images — see below |
gertnuusbrief.briefingArticleCount |
25 |
Headlines sent to the model |
Commands
All under the GertNuusbrief: prefix in the command palette.
Refresh Feeds · Generate Briefing · Mark All as Read ·
Add Watchlist Term · Open Settings
Notes for the security-minded
You are the target audience, so the details are worth stating plainly:
- Images are off by default. Feed images are frequently tracking pixels. Leaving them on tells a publisher which advisories you opened and when. Turn them on if you want them.
- Feed content is never rendered as HTML. Titles and summaries are stripped
of markup on the way in and written to the DOM with
textContenton the way out. The webview runs underdefault-src 'none'with a per-load script nonce. - Only http(s) links are accepted. An article whose link uses any other scheme is dropped rather than rendered.
- Network calls go through Node's
http/httpsmodules, which is what VS Code's proxy support actually patches. Behind a corporate proxy this works wherefetchsilently times out. - The briefing is instructed not to invent things — no CVE identifiers, vendors or versions that were not in the headlines. Treat it as a reading aid, not a source. The links are the source.
- Nothing is sent anywhere except your configured feeds and, when you press the button, your headlines to the language model you already use.
Licence
MIT