Inspiration
A cyber incident can take away more than servers. It can take away the tools responders rely on to coordinate: corporate SSO, internal chat, ticketing, and asset inventories. If those systems are compromised, where does the team go to make its next decision?
BreachBay is an independently hosted incident command center where responders establish a shared picture, inspect evidence, and evaluate responses using identities separate from the affected organization.
What it does
Dedicated Clerk accounts establish identity. Explicit incident memberships establish access. SpacetimeDB subscriptions keep messages, tasks, acknowledgments, evidence, proposals, and activity synchronized across responders.
Evidence uploads retain immutable original bytes and SHA-256 integrity records. A separate sanitized derivative requires human approval for model use. The response topology connects assets, evidence-backed communication paths, and service dependencies with inspectable provenance. Unverified model findings remain labeled hypotheses.
NVIDIA Nemotron investigates through bounded, incident-scoped tools. Citations are checked against evidence actually retrieved, including its version and excerpt hash. Typed recommendations and independently simulated alternatives expose assumptions, uncertainty, service disruption, and remaining exposure. The AI service cannot approve or execute a response, and cannot download original evidence.
The credential-compromise scenario makes the tradeoff visible. Isolating an application host interrupts one spread path and degrades the customer portal, while a jump-host route to the database remains. A later route block removes that modeled path. Preview and execution share deterministic rules; human approval binds the proposal payload and scenario version. A verified action means the synthetic outcome matched that prediction, including disruption. It does not establish real-world containment.
How we built it
Next.js, React, and TypeScript power the application. React Flow and Dagre render the topology; Motion, self-hosted typography, and a restrained Harbor identity support a focused workspace.
SpacetimeDB is the sole transactional operational store. Reducers enforce incident permissions, expected versions, idempotency, approval expiry, and audit recording. Private tables expose caller-scoped views tied to original authenticated read leases. Token renewal does not replace recent password verification for privileged actions.
A protected gateway calls NVIDIA's hosted nvidia/nemotron-3.5-lightning-30b-a3b through an allowlisted tool registry. Schema, citation, scope, and planning validators run before recommendations become canonical incident state. Scenario snapshots support historical comparison and restoration as a new increasing version, preserving earlier decisions and verifications.
The application and self-hosted database run on Vultr behind HTTPS and restricted ingress. Evidence originals, credentials, and backups remain outside application source and browser artifacts. Required font/icon license notices accompany the source. I used AI coding assistance alongside open-source packages; BreachBay's workflow, authorization integration, scenario engine, and interface composition are project-specific work.
Challenges we ran into
Real-time state and AI orchestration made the trust boundaries the hardest part. Identity must not silently grant incident access. A changed scenario must invalidate an old decision. A retry must not execute a response twice. I enforced these conditions in the transactional backend and checked denied operations alongside successful ones.
The pinned database SDK generated codecs at runtime, conflicting with the strict Content Security Policy. Project-owned closure codecs restored subscriptions while preserving the policy and tested wire compatibility.
Real model tool use sometimes succeeded while the final response failed schema or citation validation. I retained those failures, added constrained native structured finalization within the existing correction allowance, and kept the local validators intact. Plausible text never substitutes for a completed investigation.
Accomplishments that we're proud of
BreachBay is deployed at breachbay.us. Two independently authenticated responder accounts exchanged messages and task updates without refreshing; the investigator was denied a separate commander-only incident.
The deployed original-evidence integrity and human/model boundaries passed. The actual scoped AI service was denied original downloads and, after genuine recent authentication, denied approval and execution.
A real Nemotron investigation completed six distinct tools, produced two validated cited findings and a typed proposal, and led to renewed human approval, one verified synthetic app-host isolation, and an exported audit report. The portal disruption and unresolved jump-host route remained explicit.
I intentionally disabled inference. A run failed with zero tools, findings, or AI proposals, while the separate investigator still collaborated, drafted a manual route block, and previewed it. The human-confirmed commander decision, verified execution, and report export all succeeded while inference remained disabled.
After a versioned restore, a fresh real Nemotron reassessment completed three distinct tools, cited the new post-isolation observation with exact version/hash proof, and independently previewed a route block and credential reset. A malicious instruction embedded in the synthetic evidence was retrieved as data without granting the model approval or execution authority. Requester cancellation and late-write rejection also passed.
The live browser rejected stale execution while approved, executed one current human-approved response at v5, returned the identical historical receipt on exact replay, rejected a new-key terminal duplicate, and rejected approval bound to the old scenario. Report checks retained the earlier verified actions and confirmed the separate pending control was never approved or executed.
A commander accepted the historical observation and independently verified an investigator-authored descriptive evidence relationship using current versions and hashes. Revoking the investigator's membership removed all incident state from the already-open authenticated subscription, without refreshing. These metadata and permission changes left scenario v5 and its execution history unchanged.
Reviewed source is public at github.com/richmondazadze/breachbay. Private environments, original PRD, internal documentation, screenshots, evidence originals, and operational history are excluded.
The final deployed review also verified deterministic read-only replay of the recorded v4-to-v5 execution, audited preservation settings with indefinite retention and a commander hold, chronology filters, and keyboard-accessible asset details. The expanded report retained every earlier action, decision, verification and snapshot while adding finding-review metadata, manual assumptions and uncertainty, preservation policy, and provider-call records.
Durable telemetry was verified across seven actual NVIDIA requests, including native JSON finalization, with unique request IDs, exact model and endpoint, synthetic classification, measured latency, genuine reported token usage, and explicitly unknown monetary cost. That subsequent v5 run completed five validated tools, including the action-status reader, but its invalid final response was rejected and retained as FAILED without creating a proposal or changing scenario state.
What we learned
An incident assistant needs evidence provenance, uncertainty, and a clear decision boundary alongside a strong model. Live updates help only when responders can tell whether state is current, who changed it, and what evidence supports it.
A response can work exactly as predicted and still leave another path open. Showing that remaining path gives the team a concrete basis for its next decision.
What's next for BreachBay
Beyond the hackathon, I want broader synthetic scenarios, richer evidence adapters, stronger external audit anchoring, and carefully reviewed operational integrations. Any real containment connector would need its own permissions and deployment review.
All hackathon evidence and response actions are synthetic. Independence assumes responder devices, Clerk, and Vultr remain trustworthy. Optional voice, screenshot extraction, and fallback models are deferred.
Built With
- clerk
- dagre
- motion
- next.js
- nvidia-nemotron
- react
- react-flow
- spacetimedb
- typescript
- vultr
