BroadSec

💡 Inspiration

The Moroccan digital landscape is accelerating rapidly. E-commerce platforms, local startups, and public services are digitizing every day. However, traditional penetration testing remains highly expensive, slow, and inaccessible to many businesses. While Bug Bounty programs offer a results-driven alternative, companies are consistently overwhelmed by thousands of poorly written, unverified reports, complicated by local language barriers (Darija/French vs. English) and complex CNDP data privacy compliance requirements.

We built BroadSec to bridge this gap: Morocco's first automated, cloud-native, AI-driven Bug Bounty platform that instantly triages incoming security reports, runs on-demand baseline surface scans, and formats submissions flawlessly into enterprise-ready documentation.

⚙️ What it does

BroadSec serves as a dual-sided security ecosystem optimizing interactions between local security researchers and engineering teams:

AI Vulnerability Triage: When a researcher submits a raw, disorganized report—even in Moroccan Darija or French—our specialized Gemini engine analyzes it. It enforces strict bug-bounty constraints, evaluates the presentation of a concrete Proof-of-Concept (PoC), calculates an algorithmic CVSS 3.1 score and vector, and generates distinct simple summaries for non-technical leadership and explicit deep-dives for developers.
On-Demand Web Scanner: Integrates an immediate surface engine that parses target URLs to analyze critical missing HTTP security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy), flag server version disclosures, and actively evaluate active SSL/TLS handshake configurations and certificate lifecycles.
Multilingual Translation Module: Seamlessly normalizes technical reporting barriers by translating dense security concepts across French, Modern Standard Arabic, conversational Moroccan Darija, and professional English while keeping technical tokens, CVEs, and exploits completely pristine.
Agile Core Management: Forwards valid, structured intelligence directly to an isolated Kanban management interface where platform administrators can effortlessly track, handle, and clear security risks.

🛠️ How we built it (GCP Architecture)

We rejected monolithic structures to design an agile, production-grade microservices architecture built entirely on Google Cloud Platform (GCP), deployed securely via Infrastructure as Code (IaC):

Frontend Layer: Built a fully responsive web application using Next.js, styled seamlessly with Tailwind CSS and premium Shadcn/ui analytics dashboards. Containerized and deployed serverless onto Google Cloud Run to ensure near-zero latency and horizontal scaling.
Serverless AI Middleware: Engineered an independent Python FastAPI microservice engine on Google Cloud Run. This layer communicates directly with the Google Gemini 2.5 Flash model using advanced prompt engineering to strictly constrain response payloads into parseable JSON structures, filtering out text hallucinations.
Core Routing Platform: Deployed a persistent Ubuntu Linux Server on Google Compute Engine to securely host our core platform engine.
Security & IaC Hardening: Rather than utilizing cloud web UI consoles, we explicitly provisioned all underlying GCP infrastructure—including network rules, specific zoning, and isolated ingress firewalls—using Terraform. The core Compute Engine platform is heavily locked down, exclusively exposing port 6320 to public access points.

🧠 Challenges we faced

The primary bottleneck revolved around API structural consistency. Generative language models frequently wrap responses in standard Markdown code blocks, which breaks typical backend JSON parsers and crashes frontend dashboards. We mitigated this by introducing string normalization pipelines that clean formatting artifacts before ingestion. Additionally, configuring explicit environment-level API handshakes securely across cross-origin microservices on serverless platforms required meticulous validation of network rules.

🏅 Achievements that we're proud of

Successfully deploying a decentralized, decoupled multi-tier security application completely via Infrastructure as Code in record time.
Designing highly precise contextual prompt blocks that empower an LLM to accurately navigate conversational Moroccan Darija inputs while preserving strict global security standards like CVSS.
Achieving a highly performant live architecture where data flows seamlessly from a Next.js client request, through serverless AI translation pipelines, directly into a firewalled core VM engine.