# Vendor security review board built on your vendor sheet

> Open any vendor to see a live view of what they expose on the internet, record a risk tier and notes, and write the decision straight back to your register.

- Workflow type: app
- Services: Censys, Google Sheets, Slack Bot
- Categories: Operations
- Published: 2026-08-16

## What it does

- Loads your vendor register from Google Sheets into a portfolio table showing each vendor's risk tier and last review date, with a clear flag on anyone not reviewed in the past quarter.
- Opening a vendor pulls a fresh external security profile from Censys: which services and ports they expose, what software is running, how their main websites and certificates look, and what other infrastructure sits around their domain.
- Reviewers record a tier, notes, and a review date in the app, and the decision writes straight back to the spreadsheet so the register stays the single source of truth.
- Puts two or three vendors side by side so you can decide which ones deserve a deeper assessment this quarter, then posts the outcome to your risk channel in Slack.

## What you'll need

- A Google Sheet holding your vendor register, one row per vendor with at least a name and a website domain
- A Censys account for the external security lookups
- A Slack workspace, if you want review decisions posted to a risk channel

## Prompt

Build an app my risk team can run our third-party vendor security reviews out of. Our vendor register lives in a Google Sheet with one row per vendor, so load it with Get Values and treat that sheet as the system of record. Censys is read only, so every tier, note, and review date has to live in the spreadsheet, not somewhere else in the app.

The home view is a vendor portfolio table: vendor name, domain, current risk tier, last review date, who reviewed it, and a short note. Flag anyone not reviewed in the past quarter as overdue, and let me sort and filter by tier, by overdue status, and by oldest review first. Show the count of overdue vendors at the top so I can see the size of this quarter's queue before I start.

Opening a vendor runs a live external posture profile from Censys against their domain. Use Run a Search Query scoped to that domain to pull their hosts and certificates. Use Aggregate Search Results to break the exposed services down by port and by software, so I can see the shape of their surface at a glance. Use Get a Web Property for their main sites on ports 80 and 443 to inspect what those front doors are serving. Use Get a Certificate to check the TLS certificate on the main site. Use Get DNS Resolution Records for a Name (Bounds) to show the surrounding infrastructure the domain resolves to.

Do not dump raw scan output. Lead the profile with a short findings list of the signals a reviewer actually acts on: expired, self signed, or weak TLS certificates; admin and database ports reachable from the internet such as RDP, SSH, MySQL, PostgreSQL, MongoDB, Elasticsearch, and Redis; end of life or clearly outdated software versions; and unexpected sprawl such as a large number of distinct hosts or hosting providers behind one domain. Each finding gets one plain sentence explaining why it matters, with the underlying evidence expandable below it. The audience is a risk or compliance reviewer, not a security engineer, so keep the language plain.

Below the profile the reviewer records a decision: a risk tier, free text notes, a review date defaulting to today, and a flag for whether this vendor needs a deeper assessment. Saving writes the decision back to that vendor's row in the register with Update Values, matching the row on the vendor's domain, and appends a row to a review history tab with Append Values so we keep an audit trail of past reviews. Stamp the decision with the name of the reviewer who is signed in.

After saving, the reviewer can post the decision to our risk channel with Slack Send a Message, including the vendor name, the new tier, the headline findings, and whether a deeper assessment was requested.

The real job each quarter is deciding which vendors deserve a deeper assessment, so let reviewers select two or three vendors and put their profiles side by side in a comparison view, aligned row by row on the same signals: exposed ports, software, certificate health, surrounding infrastructure, and current tier. Keep the comparison scannable rather than exhaustive, since it exists to support a ranking decision.

Censys lookups are metered, so fetch a vendor's profile when that vendor is opened rather than for the whole portfolio up front, hold it while the app is open, and give the reviewer a refresh button when they want a fresh pull.

## How to customize

- Change the review window from a quarter to whatever your policy requires, such as 90 days for critical vendors and 6 months for low-tier ones.
- Adjust the risk tier labels and which findings get highlighted first, such as exposed database ports, expired certificates, or outdated software.
- Point the Slack post at a different channel, or skip it and keep reviews inside the app and the spreadsheet.

## FAQ

### Do our vendors need to know we are running this?

No. Everything shown here is already visible from the public internet, the same way anyone could look it up. Nothing is installed on the vendor's side and no questionnaire is sent to them.

### Will this change how my spreadsheet is set up?

It reads the columns you already have and writes the tier, notes, and review date back to the same rows. If your register does not yet have columns for risk tier and last reviewed, add them once and the app keeps them filled in.

### Does this replace security questionnaires?

No. What a vendor exposes publicly is one of the three standard inputs to a review, alongside contract terms and the vendor's own answers. This app covers the part you can gather without asking them anything.

### How many vendors can I compare at once?

Two or three side by side. That is usually what the quarterly decision comes down to, and it keeps the comparison readable.

### Is the security information live or a saved snapshot?

The profile is pulled fresh each time you open a vendor. The tier, notes, and review date you record are saved back to your spreadsheet as the lasting record of the review.

Use this prompt in General Input: https://www.generalinput.com/prompts/vendor-security-review-board-built-on-your-vendor-sheet