Beeswax is a zero-trust, air-gapped incident response platform built to serve as a secure command center during active, hostile network breaches.
Inspiration
We all have a strong interest in cybersecurity, and our conversations with industry professionals revealed a stark reality: during a SEV-1 breach, attackers often monitor corporate Slack, Teams, and Active Directory. We built this project for the Winstead PC challenge to give incident commanders a defensible, out-of-band workflow when the enterprise network is totally compromised.
What it does
- The Honeycomb: A real-time hex-grid map tracking the blast radius, tagging PHI/PII and Crown Jewels, with a toggle to overlay Nessus vulnerability risk.
- Tamper-Evident Ledger: An append-only, SHA-256 hash-chained audit log. If an attacker alters the database, the cryptographic chain visually breaks in the browser instantly.
- Out-of-Band Comms: Built-in WebSocket chat using the native WebCrypto API to keep communications hidden from the tapped corporate network.
- CISO Briefings & Defense Matrix: Auto-generates "Confirmed vs. Unknown" executive summaries to mitigate FUD, complete with HIPAA 60-day notification regulatory checklists.
How we built it
Designed for assume breach environments, it runs as a single self-contained unit with zero external network dependencies (no cloud CDNs).
- Frontend: React 18, Vite, TypeScript, Zustand, and Tailwind CSS/shadcn.
- Backend: Node/Express,
ws(native WebSockets), and better-sqlite3. - Integrity Engine: Standard W3C Web Crypto API (
crypto.subtle) for the in-browser hash verification.
Challenges we ran into
- Air-Gapped Constraints: Bundling everything locally to ensure zero external requests, meaning we couldn't rely on standard cloud fonts or external APIs.
- Cryptographic Verification: Building the logic for the browser to independently recalculate and verify the SHA-256 hash chain of the entire database in real-time.
- Hash-Chain Concurrency: Preventing race conditions in the ledger when multiple responders update the map simultaneously.
Accomplishments that we're proud of
- Building the "Tamper Demo" Showstopper: a live, legally defensible chain-of-custody verifier that instantly flags database manipulation.
- Designing the Honeycomb UI to cleanly visualize complex state (blast radius, CVEs, PHI) without overwhelming stressed incident commanders.
- Integrating Role-Based Access Control (RBAC) to separate Admin, Responder, and Legal Viewer (privileged) workflows.
What we learned
- Translating the NIST 800-61 incident response lifecycle and CISO judgement frameworks into a functional UI.
- Understanding compliance exposure, specifically HIPAA 45 CFR ยง 164.404 regulations regarding compromised PHI.
- Implementing applied cryptography and building "stress-mode" user interfaces.
What's next for Beeswax
- Hardware Attestation: Moving the hash chain to a hardware TPM / HSM enclave for true cryptographic timestamping.
- Automated Ingestion: Live Tenable.io API sync for continuous attack-surface discovery.
- Regulatory Automation: A one-click SEC Form 8-K cyber incident draft generator.
- Phishing-Resistant MFA: Biometric passkey logins via WebAuthn/FIDO2.
