Vendor breach exposure board for your SaaS register

Build me a vendor breach exposure board: a third party risk screen that turns our existing SaaS vendor spreadsheet into a live view of which vendors have been breached and, more importantly, which of our own staff were caught in those breaches.

The vendor register is the source of truth and it lives in Google Sheets. Read it with Get Values. Each row is one vendor with the vendor name, their website domain, the internal owner, and how sensitive the data we store there is. Let me choose the spreadsheet and the tab or range on first load and remember that choice. Match columns by header name rather than fixed position so the sheet does not have to be reordered, and show me a small mapping screen if a required column cannot be found.

For every vendor, check breach history with Have I Been Pwned Get All Breached Sites filtered by that vendor's website domain. For each breach found, show the breach name, the breach date, the number of accounts involved (PwnCount), and the data classes exposed. A vendor can have more than one breach, so show the most recent one inline and let the rest expand in the row detail. This list is public, so it is the only vendor side data source the app uses.

The column that makes this worth opening is our own exposure. Once per scan, pull the breached aliases on our verified company domain with Get Breached Email Addresses for a Domain. That returns each breached alias on our domain along with the breach names it appeared in. Intersect those breach names with each vendor's breach names, and the result is the exact list of people at our company who had an account at that vendor when it was breached. Show the affected count on the row and the actual staff aliases in the row detail. Use Get Subscribed Domains to list the domains verified on our subscription and let me pick which company domain the board runs against.

Important feasibility constraint to respect throughout: the domain based lookups (breached email addresses for a domain, and stealer logs by email domain) only work on domains verified in our own Have I Been Pwned subscription. Never run them against a vendor's domain. Vendor side data comes only from the public breached sites list filtered by domain, and the join between vendor breaches and our own exposure is the breach Name field. Every request to Have I Been Pwned also needs a descriptive User-Agent header.

Domain search and the domain based stealer log lookups have their own separate and lower rate limits than the subscription request rate, so scan vendors in batches with backoff, reuse the single company domain pull across all vendor rows rather than repeating it per vendor, and cache the scan results with a timestamp in the app instead of refetching on every render. Give me a refresh control for the whole register and a re-check action on a single vendor row, and show when the data was last refreshed.

Sort the board by how many of our staff were affected, descending, then by data sensitivity, then by how recent the breach was. Vendors where nobody at our company was affected sink to the bottom. Make the empty state useful: a vendor with no breach history should read as clean and dated, something like "No known breaches, checked 12 March", with a clean status chip, never as a blank row. A vendor that has breaches but no affected staff should read as breached but not exposed, which is a different state again.

From a vendor row I want two actions. First, mark it reviewed: capture a review date and notes, write them back onto that vendor's row in the register with Update Values, and append a line to a review log tab with Append Values recording the vendor, who reviewed it, the date, and the notes. Second, share the vendor's exposure summary to our IT channel with the Slack Bot Send a Message operation, covering the vendor and owner, the breaches and their dates, the data classes exposed, and how many of our people were affected with their aliases. Let me pick the channel and edit the message before it sends.

Add an "Assess this vendor" button on each row that runs a background agent. The agent reads the full record for each breach at that vendor with Get a Single Breach, then checks Get Stealer Logs by Email Domain for our verified company domain and filters the returned website captures for that vendor's website domain to see whether any of our staff have had credentials captured against it. It then writes a short risk memo back into the app on that vendor row covering what was exposed, who at our company is affected, whether any of them show stealer log captures against the vendor, and a clear recommendation on whether to force password resets or escalate the vendor relationship. Show the run state on the row while it is working, stamp the memo with a date, keep previous memos in the row detail as history, and let me share the memo to Slack with the same message action.