Design Vulnerability Scanner - System Design | WinJob

Problem Statement and Scanner Mission

A multi-tenant platform schedules network, host, container, and repository scans, normalizes results to a canonical finding model, deduplicates by asset+CVE+location fingerprint, and routes remediation with risk-based prioritization (CVSS × EPSS × exposure).

Design anchors (1)

Separate scan orchestration from CVE intelligence feeds so policy updates never block running jobs.
Treat false-positive budget as an SLO: developers must not drown in duplicate tickets.
Never store raw credentials in findings—redact secrets at the collector boundary.

Failure drills

If CVE mirror lags beyond 6h, freeze policy promotions and serve last-good NVD snapshot with stale_intel=true on new findings. If correlator dedupe cache (Redis) fails, fall back to database fingerprint lookup with 3× latency and page platform. If worker pool exhausts subnet scan budget, defer non-production assets and extend SLA for internal tiers. If ticket bridge returns 429, exponential backoff with jitter while findings stay open in platform—not lost.

Cost and capacity

At 2.8M Managed assets, right-size parser tier before adding intrusive scanners—CPU on authenticated checks dominates. Chargeback tenants on completed scan credits and ingested finding GB.

Signal	Target
Managed assets	2.8M
Peak findings/min	180K
CVE feed lag	<6 h
MTTR P1	72 h

javaOne Dark Pro

1 public record ScanFinding(String tenantId, String assetId, String cveId, String fingerprint, double riskScore) {
2   public String partitionKey() { return tenantId + ":" + assetId.substring(0, 8); }
3 }

pythonOne Dark Pro

1 def dedupe_fingerprint(asset_id: str, cve_id: str, path: str) -> str:
2     return f"{asset_id}:{cve_id}:{hash(path) & 0xFFFFFF:06x}"

typescriptOne Dark Pro

1 export interface PolicyGate {
2   blockOn: ("critical" | "high")[];
3   graceDays: number;
4 }
5  
6 export function shouldBlock(gate: PolicyGate, severity: string): boolean {
7   return gate.blockOn.includes(severity as "critical" | "high");
8 }

Why interviewers care

Vulnerability Scanner interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement and Scanner Mission that proves you understand real outages, not happy-path diagrams.

Key Highlights

•A multi-tenant platform schedules network, host, container, and repository scans
•Metrics: Managed assets, Peak findings/min, CVE feed lag, MTTR P1
•Separate scan orchestration from CVE intelligence feeds so p

1	public record ScanFinding(String tenantId, String assetId, String cveId, String fingerprint, double riskScore) {
2	public String partitionKey() { return tenantId + ":" + assetId.substring(0, 8); }
3	}

1	def dedupe_fingerprint(asset_id: str, cve_id: str, path: str) -> str:
2	return f"{asset_id}:{cve_id}:{hash(path) & 0xFFFFFF:06x}"

1	export interface PolicyGate {
2	blockOn: ("critical" \| "high")[];
3	graceDays: number;
4	}
5
6	export function shouldBlock(gate: PolicyGate, severity: string): boolean {
7	return gate.blockOn.includes(severity as "critical" \| "high");
8	}