For #460. Set groundwork for an NVD API key

build.gradle

@@ -244,6 +244,10 @@ dependencyCheck {
     skip = Boolean.getBoolean("owasp.skip") // DEFAULT is false
     suppressionFile = rootProject.file("config/owasp-suppressions.xml")
 
+    nvd {
+        apiKey = findProperty("owasp.nvdApiKey") ?: System.getenv("OWASP_NVD_API_KEY")
+    }
+
     // Use this block when mirroring the NIST CVE data -- the data may suffer
     // timeouts for downloading. GitHub, for example, maintains caches of the
     // data, and you might see your local build fail for access, but pass in CI

pom.xml

@@ -89,6 +89,7 @@
         <maven.version>3.9.6</maven.version>
         <mockito.version>5.11.0</mockito.version>
         <modernizer.version>2.8.0</modernizer.version>
+        <owasp.nvdApiKey>${env.OWASP_NVD_API_KEY}</owasp.nvdApiKey>
         <owasp.skip>false</owasp.skip>
         <pitest-junit5-plugin.version>1.2.1</pitest-junit5-plugin.version>
         <pitest-maven.version>1.16.0</pitest-maven.version>
@@ -460,6 +461,7 @@
                     <!-- This is not dotnet code -->
                     <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                     <failBuildOnCVSS>0</failBuildOnCVSS>
+                    <nvdApiKey>${owasp.nvdApiKey}</nvdApiKey>
                     <skip>${owasp.skip}</skip>
                 </configuration>
                 <executions>