diff --git a/scripts/build.py b/scripts/build.py
index 1db10a8..6763520 100644
--- a/scripts/build.py
+++ b/scripts/build.py
@@ -36,23 +36,15 @@ def get_git_revision(path):
 
 def input_files(repo):
     d = repo / 'data'
-
-    if not d.is_dir():
-        raise RuntimeError(
-            f'Data directory missing: {d}'
-        )
-
-    if repo.name == 'vuln-cve':
-        files = sorted(d.rglob('CVE-*.json'))
-
-        if not files:
-            raise RuntimeError(
-                f'No CVE records found in {d}'
-            )
-
-        yield from files
+    if not d.exists():
         return
 
+    # Nur tatsächliche CVE-Datensätze einlesen
+    if repo.name == 'vuln-cve':
+        yield from sorted(d.rglob('CVE-*.json'))
+        return
+
+    # Andere Quellen unverändert verarbeiten
     yield from sorted(d.rglob('*.json'))
 
 
@@ -102,9 +94,10 @@ def walk_cpe(node, allow_simple=True):
 
 
 def process_nvd(db,obj):
-    cve=obj.get('cve')
-    if not isinstance(cve,dict):
+    # NVD mirror stores the CVE object directly; API responses wrap it in {'cve': ...}.
+    if not isinstance(obj,dict):
         return False
+    cve=obj.get('cve') if isinstance(obj.get('cve'),dict) else obj
     vid=cve.get('id')
     if not isinstance(vid,str) or not CVE.match(vid):
         return False
@@ -185,6 +178,8 @@ def stream_source(db,name,path):
                 print(f'INVALID {name} {file}: {exc}',flush=True)
     if bad:
         raise RuntimeError(f'{name}: {bad} invalid records; database not published')
+    if name == 'vuln-nvd' and count == 0:
+        raise RuntimeError('vuln-nvd: no usable documents; check source data and JSON shape')
     return count