Pipeline Architecture

Autonomous Pipeline

The WebKit Security Intelligence pipeline operates in three stages, running continuously to ingest, correlate, and analyze security findings.

1. Ingestion

Data sources:

Source	Endpoint	Data
Apple Security Advisories	`support.apple.com/en-us/100100`	CVE, Bugzilla ID, impact, affected products
NVD	`services.nvd.nist.gov/rest/json/cves/2.0`	CVSS, CWE, description
CISA KEV	`api.cisa.gov/known-exploited-vulnerabilities/catalog`	Exploitation status
WebKit Bugzilla	`bugs.webkit.org/rest/bug/{id}`	Bug metadata, status, resolution
GitHub Commits	`api.github.com/search/commits`	Patches, commit messages

Apple advisories are the primary source because security bugs in Bugzilla remain private until Apple discloses them. The advisory surfaces the CVE→Bugzilla mapping that Bugzilla itself won’t show pre-disclosure.

2. Correlation

For every (CVE, Bugzilla ID) pair:

Apple Advisory  &rarr;  CVE + Bug ID  &rarr;  GitHub Search (commits + PRs)
                                                    &darr;
                                          Deduplicate & Rank
                                                    &darr;
                                    Primary Fix  +  Cherry-picks

Commit search queries:

repo:WebKit/WebKit show_bug.cgi?id={bug_id}
repo:WebKit/WebKit "Bug {bug_id}"
repo:WebKit/WebKit "https://bugs.webkit.org/show_bug.cgi?id={bug_id}"

PR search queries:

repo:WebKit/WebKit show_bug.cgi?id={bug_id} type:pr
repo:WebKit/WebKit "Bug {bug_id}" type:pr

Primary fix selection:

Commit on main branch → primary fix
PR merging to main → primary fix
Everything else → cherry-pick / backport
PR body contains “Originally-landed-as” → trace original commit

3. Analysis

Patch diff parsing → component, bug class, changed functions
Rule-based classification → UAF, OOB, Race, TypeConfusion, etc.
LLM-assisted RCA → root cause, attack path, primitive
Test case extraction → trigger conditions, PoC skeleton