GertNuusbrief

A blue team news desk that lives in your VS Code sidebar.

Ten security feeds, aggregated into one scrollable card feed, with an anchor-style briefing at the top summarising what happened while you were asleep. Built for the analyst who opens the editor before they open a browser.

Nuusbrief is Afrikaans for "news bulletin".

What it does

A briefing, not just a list. Press Generate briefing and the extension writes you a short bulletin: a lead story, a handful of themed bullets, anything that hit your watchlist, and one concrete thing to check today.

A watchlist that finds your estate. Add the vendors and products you actually run. Matching stories get an accent rail, a chip naming the term, and a lift to the top of the feed until you have read them. Optionally, a notification when a new one lands.

Read state that survives. Read, unread and bookmarked are tracked per article and persist across workspaces and restarts. The feed dims what you have already seen instead of showing you the same wall every morning.

Handover-ready export. Any article copies out as a Markdown blurb — title, link, source, ISO date, summary — ready to paste into a ticket or a shift note.

Requirements

The feed works on its own with no setup.

The briefing uses VS Code's Language Model API, which runs on your existing GitHub Copilot subscription. There is no API key to obtain, paste or store — and no key for this extension to leak. If Copilot is not installed, the briefing button explains that and everything else keeps working.

The first briefing triggers a one-time VS Code consent prompt.

Sources and categories

134 feeds ship with the extension, in six categories. Only the ten news and advisory sources are enabled by default, so the first refresh is quick and the feed stays readable. The rest are one enabled: true away in settings.

A category chip row appears under the filters as soon as more than one category has articles, showing live counts. Chips come from your settings, so inventing your own category is just a matter of typing it — no chip list to maintain.

gertnuusbrief.sources takes any RSS 2.0, Atom or RDF feed. enabled: false mutes a source without losing its URL, and category groups it.

Each source contributes at most its 50 newest articles per refresh, so one blog that serves its whole archive cannot crowd out everything else.

Settings

Commands

All under the GertNuusbrief: prefix in the command palette.

Refresh Feeds · Generate Briefing · Mark All as Read · Add Watchlist Term · Open Settings

Notes for the security-minded

You are the target audience, so the details are worth stating plainly:

• Images are off by default. Feed images are frequently tracking pixels. Leaving them on tells a publisher which advisories you opened and when. Turn them on if you want them.
• Feed content is never rendered as HTML. Titles and summaries are stripped of markup on the way in and written to the DOM with textContent on the way out. The webview runs under default-src 'none' with a per-load script nonce.
• Only http(s) links are accepted. An article whose link uses any other scheme is dropped rather than rendered.
• Network calls go through Node's http/https modules, which is what VS Code's proxy support actually patches. Behind a corporate proxy this works where fetch silently times out.
• The briefing is instructed not to invent things — no CVE identifiers, vendors or versions that were not in the headlines. Treat it as a reading aid, not a source. The links are the source.
• Nothing is sent anywhere except your configured feeds and, when you press the button, your headlines to the language model you already use.

Licence

MIT