AEGIS

AEGIS is a real-time API compliance scanner that detects sensitive data leaks, maps regulatory violations, and catches exposed user data before regulators or attackers do.

Comment

INSPIRATION

I wasn't looking for a hackathon idea. I was reading a legal brief. BRITISH AIRWAYS. £20 MILLION. No hacker. No breach. Just an API — their own API — quietly returning data it was never supposed to return. For months. To anyone who called it. The engineers who built it were good. They just never had a tool that looked at what their API was ACTUALLY returning versus what it was SUPPOSED to return. Nobody did. They trusted their code. Their code trusted its data. And somewhere in that chain of trust, a field slipped through that never should have left the server. I kept thinking: “THIS IS HAPPENING RIGHT NOW. AT THOUSANDS OF COMPANIES. AND NOBODY KNOWS.” That's when AEGIS became inevitable.

WHAT IT DOES

Aegis scans every endpoint in your API, detects sensitive data leakage across three AI-powered layers, maps every violation to the exact regulation it breaches — GDPR, HIPAA, PCI-DSS, CCPA — and calculates your fine exposure in dollars based on your actual user count. Then it generates two outputs simultaneously:

→ An executive brief written in board-meeting language for legal and leadership teams
→ An engineering remediation guide with before/after code diffs that developers can act on immediately The entire scan completes in under 60 seconds.

HOW WE BUILT IT The detection pipeline runs three layers deep.

LAYER 1 — Microsoft Presidio handles named entity recognition: names, emails, SSNs, medical terms, and financial data.

LAYER 2 — A custom regex engine catches what NER misses: raw card numbers, bcrypt password hashes, JWT tokens, precise geolocation coordinates.

LAYER 3 — A structural field-name classifier catches the rest: because a field named password_hash is dangerous regardless of what value it contains. Every detection flows into a CENTRAL FINDINGS SCHEMA. One source of truth that everything downstream reads from: the UI, the regulatory mapper, the fine exposure calculator, and the AI report generator. ONE SCHEMA. EVERYTHING CONSISTENT. NOTHING DUPLICATED. The backend runs on FastAPI with fully async Server-Sent Events, streaming findings to the React frontend in real time as each endpoint is scanned. The AI layer uses Gemini to generate structured executive briefs and engineering fixes, with enforced JSON output so the results remain parseable, deterministic, and actionable.

CHALLENGES WE RAN INTO

The hardest problem was consent mapping. The first instinct was to send a privacy policy to an AI model and ask: “Is this field covered?” That produced inconsistent results because privacy policies are intentionally vague. The solution was a structured taxonomy of 30 predefined data categories. The AI extracts which categories a policy covers ONCE, stores them as structured JSON, and every comparison after that becomes deterministic, auditable, traceable, and defensible in front of a regulator. The second challenge was false positives. A security tool that cries wolf gets ignored. Confidence tiers — DEFINITE, PROBABLE, POSSIBLE — surface detection confidence directly in the UI so teams learn to triage rather than panic. That distinction is the difference between a tool teams adopt and a tool they uninstall after the first noisy scan.

ACCOMPLISHMENTS WE'RE PROUD OF

A complete, working compliance intelligence pipeline — built solo in under 24 hours.

→ Real PII detection across three independent layers
→ Real regulatory mapping across four compliance frameworks
→ A live streaming dashboard showing sensitive fields appearing in real time
→ AI-generated executive reports and engineering remediation guides
→ A fine exposure calculator translating security risk into business impact But the real accomplishment is the architecture itself. Every layer exists for a reason. Every output is traceable back to its source. That's not just a hackathon demo. That's a PRODUCT FOUNDATION.

WHAT WE LEARNED

The hardest problems in security aren't technical. They're human. APIs don't leak data because engineers are careless. They leak because the feedback loop between engineering and compliance is fundamentally broken. Audits happen once a year. Manually. Expensively. By consultants. There is no continuous signal. I also learned what it means to build something honest. A tool that overclaims gets abandoned after the first false flag. A tool that openly shows confidence scores, distinguishes DEFINITE from POSSIBLE, and clearly states “THIS IS NOT LEGAL ADVICE” becomes something teams can actually trust. That distinction — between a flashy demo and a credible product — is where the hardest engineering decisions went.

WHAT'S NEXT FOR AEGIS

DELTA SCANNING Run Aegis on every deployment and instantly see: → Which endpoints introduced new leaks
→ which leaks were fixed
→ when the change happened This transforms Aegis from a one-time audit into a continuous compliance layer integrated directly into CI/CD pipelines.

THE AEGIS BROWSER EXTENSION A developer opens Swagger or Redoc documentation. Aegis automatically detects the OpenAPI specification on the page and asks: “Found 47 endpoints. Start scan?” One click. No setup. No copy-pasting URLs. The scan begins directly from the developer workflow they already use every day. That's how Aegis becomes infrastructure instead of software.

ENTERPRISE ON-PREMISE DEPLOYMENT Banks and hospitals often cannot send API responses to external cloud services. The enterprise version runs entirely inside private infrastructure. Nothing leaves the organisation. This is where the real enterprise adoption lives.

REMEDIATION TRACKING Every fix deserves visibility. When a leaking field disappears in a future scan, Aegis marks it: “RESOLVED ✓” with the exact resolution date. That single feature transforms Aegis from an audit tool into an engineering workflow system that teams use every sprint.

THE API WAS THEIR OWN. IT JUST WAS NEVER AUDITED. NOW IT CAN BE.

Built With

Share this project:

Updates

Submission history