Vendor security review board built on your vendor sheet

Build an app my risk team can run our third-party vendor security reviews out of. Our vendor register lives in a Google Sheet with one row per vendor, so load it with Get Values and treat that sheet as the system of record. Censys is read only, so every tier, note, and review date has to live in the spreadsheet, not somewhere else in the app.

The home view is a vendor portfolio table: vendor name, domain, current risk tier, last review date, who reviewed it, and a short note. Flag anyone not reviewed in the past quarter as overdue, and let me sort and filter by tier, by overdue status, and by oldest review first. Show the count of overdue vendors at the top so I can see the size of this quarter's queue before I start.

Opening a vendor runs a live external posture profile from Censys against their domain. Use Run a Search Query scoped to that domain to pull their hosts and certificates. Use Aggregate Search Results to break the exposed services down by port and by software, so I can see the shape of their surface at a glance. Use Get a Web Property for their main sites on ports 80 and 443 to inspect what those front doors are serving. Use Get a Certificate to check the TLS certificate on the main site. Use Get DNS Resolution Records for a Name (Bounds) to show the surrounding infrastructure the domain resolves to.

Do not dump raw scan output. Lead the profile with a short findings list of the signals a reviewer actually acts on: expired, self signed, or weak TLS certificates; admin and database ports reachable from the internet such as RDP, SSH, MySQL, PostgreSQL, MongoDB, Elasticsearch, and Redis; end of life or clearly outdated software versions; and unexpected sprawl such as a large number of distinct hosts or hosting providers behind one domain. Each finding gets one plain sentence explaining why it matters, with the underlying evidence expandable below it. The audience is a risk or compliance reviewer, not a security engineer, so keep the language plain.

Below the profile the reviewer records a decision: a risk tier, free text notes, a review date defaulting to today, and a flag for whether this vendor needs a deeper assessment. Saving writes the decision back to that vendor's row in the register with Update Values, matching the row on the vendor's domain, and appends a row to a review history tab with Append Values so we keep an audit trail of past reviews. Stamp the decision with the name of the reviewer who is signed in.

After saving, the reviewer can post the decision to our risk channel with Slack Send a Message, including the vendor name, the new tier, the headline findings, and whether a deeper assessment was requested.

The real job each quarter is deciding which vendors deserve a deeper assessment, so let reviewers select two or three vendors and put their profiles side by side in a comparison view, aligned row by row on the same signals: exposed ports, software, certificate health, surrounding infrastructure, and current tier. Keep the comparison scannable rather than exhaustive, since it exists to support a ranking decision.

Censys lookups are metered, so fetch a vendor's profile when that vendor is opened rather than for the whole portfolio up front, hold it while the app is open, and give the reviewer a refresh button when they want a fresh pull.