# How to Vibe Code Your Own Feedly (and Stop Paying for It) > AI-powered intelligence platform for threat intelligence and market research - Site: https://feedly.com - Category: Cyber Threat Intelligence & News Aggregation - Platforms: Web app, iOS app, Android app, Browser extension - Verdict: **Serious undertaking** (38/100 vibecodeable) - Estimated effort: 4-6 weeks of intense solo development ## Verdict Build a personal RSS and CVE monitoring dashboard with AI summaries, but keep paying for the enterprise Threat Graph and compliance moat. Cloning Feedly's core reader and basic AI summarization pipeline is straightforward with a modern web stack, but reproducing the enterprise-grade Threat Intelligence tier is a massive engineering undertaking. You would need to orchestrate distributed scrapers across thousands of volatile security blogs, build a graph database linking hundreds of thousands of CVEs and malware families, and fine-tune models to accurately extract MITRE ATT&CK TTPs without drowning in false positives. While an AI agent can scaffold the UI, database schemas, and LLM extraction loops in a few weekends, maintaining robust scrapers and enterprise API connectors (STIX/TAXII, Jira, OpenCTI) requires ongoing maintenance that makes the commercial product's subscription a rational purchase for real security teams. ### What you can't replicate - The 18-year accumulated Threat Graph of 600M+ IoCs and proprietary entity relationships - SOC 2 Type 2 compliance certification and enterprise procurement trust - Native out-of-the-box connectors for enterprise security tools like XSOAR, MISP, and ServiceNow ## What it does Feedly is an enterprise cyber threat intelligence (CTI) and mainstream news reader platform that uses AI models, custom Intel Agents, and a Threat Graph to ingest, analyze, and distribute actionable security signals. ### Core features - Multi-source ingestion (RSS, clear/dark web scrapers, security advisories, Form 8-K filings) - AI-driven entity extraction, TTP tagging, and deduplication (AI Feeds) - Threat Graph relational database connecting articles, actors, CVEs, malware, and IoCs - Task-specific Intel Agents (Vulnerability, TTP, Cyberattack) - Ask AI RAG interface with deep source citations and Report Builder - Automated webhook and ticketing dispatch (Jira, ServiceNow, Slack) - STIX-formatted export API and MCP (Model Context Protocol) server - Automated team newsletters from saved board items ## The business ### Pricing - Pro / Individual: $6–$12/mo — For individual news readers and power researchers. - Threat Intelligence Standard: Custom quote — For mid-size security teams tracking CVEs and threat actors. - Threat Intelligence Advanced: Custom quote — For enterprise CTI teams needing full automation and integrations. ### Funding $1.3M raised. - Seed round (~$1.0M, March 2014) Investors: NFX, Angel backers Founded 2006. Team size: 55-70. ## The hard parts - Continuous mass scraping, proxy rotation, and normalization across 10,000+ heterogeneous threat feeds without IP blocks - Building and querying a low-latency graph architecture linking millions of articles to rapidly changing CVEs, malware variants, and threat actors - Fine-tuning classification models to distinguish active weaponized exploits from noise with minimal false positives - Maintaining bi-directional, reliable enterprise integrations (OpenCTI, MISP, Jira, STIX/TAXII streams) under strict uptime demands - Achieving rigorous enterprise compliance frameworks (SOC 2 Type 2) required to sell into financial and defense-adjacent CTI teams ## How to vibe code Feedly ### Prerequisites - Node.js (free): Runtime environment for the Next.js full-stack application and scraper background jobs - GitHub (free): Source control and automated deployments via Vercel - Anthropic API (Pay-as-you-go (~$10-30/mo)): Powering the Ask AI summarization and entity extraction agents ### Recommended AI tools - Claude Code: Unmatched agentic capability for scaffolding multi-file Next.js apps, writing complex parsing scripts, and debugging async ingestion pipelines - Cursor: Ideal for fine-tuning frontend dashboard components, data tables, and interactive card layouts ### Stack - Frontend: Next.js (App Router, Tailwind CSS, shadcn/ui) - Backend: Next.js Server Actions & Route Handlers with Inngest for durable background jobs - Database: Supabase (PostgreSQL with pgvector for article embeddings and relational threat data) - Auth: better-auth - Payments: None (Personal use clone) - Other: Firecrawl for scraping security blogs and RSS feeds, Resend for email alerts and newsletter digests ### Hosting - Vercel (Hosting the Next.js frontend, API routes, and serverless background trigger functions): $0-20/mo - Supabase (Relational data storage, vector embeddings for semantic search, and user authentication): $0-25/mo ### Build guide 1. **Project Scaffolding & Database Schema** — Initialize the Next.js 16 project with Tailwind CSS, shadcn/ui, and Supabase PostgreSQL with pgvector configured for threat articles and IoCs. ``` Create a new Next.js 16 project using the App Router, TypeScript, and Tailwind CSS. Initialize shadcn/ui and set up a Supabase client connection. Write a robust database schema in SQL for a threat intelligence platform with tables for: sources (id, name, url, type), articles (id, source_id, title, content, url, published_at, raw_json), entities (id, name, type [cve, threat_actor, malware, ttp]), article_entities (article_id, entity_id), and boards (id, user_id, title, description, saved_items). Include pgvector extension and an embedding column on articles for semantic similarity search. Ensure proper foreign keys, indexes on foreign keys and timestamps, and Row Level Security policies where appropriate. ``` 2. **RSS & Web Ingestion Pipeline** — Implement an automated ingestion engine using Inngest and Firecrawl to poll RSS feeds and scrape security advisory sites. ``` Build a robust ingestion background job using Inngest and Firecrawl integration. Create an API route and cron trigger that iterates through active sources, fetches RSS XML or crawls web pages using Firecrawl to extract clean markdown content, deduplicates articles by URL hash, and inserts them into the Supabase articles table. Implement error handling, exponential backoff for rate limits, and logging for failed scrapes. Write a helper function that triggers an LLM extraction pass upon successful article insertion to identify and link CVEs, threat actors, and TTPs. ``` 3. **AI Entity Extraction & Intel Cards** — Develop the AI pipeline that extracts structured CTI metadata and powers CVE/Threat Actor Insights Cards. ``` Implement an AI extraction pipeline using the Anthropic API (Claude Sonnet). When a new article is ingested, send its text to Claude with structured JSON output mode to extract: summary, sentiment, severity score (1-10), CVSS estimate, and arrays of detected entities (CVEs, malware, threat actors, MITRE TTPs). Store these extracted attributes in relational tables linked to the article. Build React UI components for Insights Cards that display article trend graphs over time, associated threat actors, timeline of mentions, and deep source citations linking back to original paragraphs. ``` 4. **AI Feeds & Custom Entity Lists** — Build the query builder interface enabling users to create custom AI Feeds filtered by tech stack, CVE threshold, or threat actor. ``` Create an 'AI Feeds' dashboard view in Next.js where users can define custom intelligence requirements using natural language or filter rules (e.g., CVEs with CVSS >= 8.0, matching custom tech stack entity lists like 'Kubernetes', 'Apple', 'Fortinet'). Implement the backend filtering logic that queries the Supabase database using both relational tags and vector embeddings to surface matching articles in real time. Include UI elements to save articles to Team Boards and trigger downstream webhooks. ``` 5. **Ask AI RAG & Report Builder** — Implement the Ask AI research panel with grounded source citations and automated newsletter generation. ``` Build an 'Ask AI' slide-over drawer and Report Builder interface in the dashboard. Implement a Retrieval-Augmented Generation (RAG) backend route that searches across ingested articles and threat graphs using pgvector similarity, feeds context into Claude with strict system instructions to cite source articles inline, and streams the response back to the client. Add a 'Generate Briefing' feature that compiles selected board items into a formatted executive summary or weekly newsletter template with export options for Markdown and HTML. ``` 6. **Integrations & Export APIs** — Add webhook dispatching for Jira, Slack alerts, and a lightweight STIX/MCP server endpoint. ``` Build an integrations settings and webhook dispatch engine. Implement server actions that trigger when an article is added to a designated 'Transfer' board, automatically formatting a payload and sending it to a configured Slack webhook URL or creating a mock Jira issue ticket via API. Additionally, create a developer API route adhering to a basic STIX 2.1 JSON structure to export indicators of compromise (IoCs), along with an MCP (Model Context Protocol) server endpoint exposing tools to query the local Threat Graph. ``` ### Cost vs paying **Starting costs (one-time):** - Domain name (optional): $12/yr - AI API credits (Anthropic/Firecrawl): $30 one-time - Total: ~$42 one-time **Ongoing costs (monthly):** - Supabase Pro DB & Vector storage: $25/mo - Anthropic API usage for daily RSS extractions: ~$15/mo - Total: ~$40/mo - Paying for the SaaS instead: $Custom Enterprise Pricing - Build time: 45-60 hours - AI tool credits: $20 (Claude Code / Cursor Pro) - Break-even: N/A (Personal build vs Custom Enterprise Quote) ## Sources - [Feedly Threat Intelligence Official Website](https://feedly.com/) - [Feedly Threat Intelligence Pricing](https://feedly.com/i/threat-intelligence/pricing) - [RH-ISAC Case Study](https://feedly.com/i/customer/rh-isac-threat-intel) - [GISA Case Study](https://feedly.com/i/customer/automating-vulnerability-monitoring)