CodeVault

• 

  Forensic Certificate — signed audit report generated per scan with chain hash proof and OWASP classification

• 

  SHA-256 Audit Chain — tamper-evident block timeline. Each block cryptographically references the previous hash

• 

  Vulnerability findings grid — 15 OWASP rules evaluated. Click any row to expand the remediation advisory

• 

  Risk Monitor HUD — live severity score, rules applied, lines scanned, and chain position updated per scan

• 

  CodeVault dashboard — forensic code security scanner with institutional titanium design, built in Kiro IDE

Inspiration

Security vulnerabilities ship to production every day because developers lack fast, forensic-grade feedback on their code. I wanted to build a tool that doesn't just flag issues — it creates a tamper-evident audit trail proving what was scanned, when, and what was found.

What it does

CodeVault is a forensic static analysis scanner with 15 OWASP Top 10 aligned rules. Paste any code snippet and it instantly detects SQL injection, eval() abuse, hardcoded secrets, XSS, command injection, path traversal, prototype pollution, weak cryptography, and more.

Every scan is appended to a SHA-256 hash chain — each block cryptographically references the previous one. Alter any past entry and the chain breaks. This makes the audit log tamper-evident by design.

The dashboard includes:

4 real-time metrics — total scans, vulnerabilities found, clean scans, chain length Cockpit split deck — code input terminal with preset vulnerable snippets + risk monitor HUD Audit cockpit table — findings grid with severity badges and click-to-expand remediation advisories Forensic receipt — scan ID, code hash, chain hash, prev hash, chain position Audit Chain tab — live chain visualization with SHA-256 block timeline Report tab — generate a signed forensic certificate per scan

How we built it

Built entirely inside Kiro IDE using its spec-driven workflow:

.kiro/specs/codevault.md — full architecture spec written before any code .kiro/hooks/post-save.json — auto-runs lint on every save .kiro/steering/ — product, tech, and structure steering documents

The backend is Node.js (zero npm dependencies — stdlib only). The frontend is a single HTML file with the PayGuard/VoteGuard institutional titanium design system. 22/22 tests passing.

Challenges we ran into

Building a forensic-grade hash chain in Node.js stdlib without any crypto library abstractions required careful attention to payload canonicalization — the SHA-256 hash must be deterministic across restarts. Getting the SSE live feed to survive connection drops without leaking memory also took several iterations.

Accomplishments that we're proud of

Accomplishments that we're proud of

• 22/22 tests passing — full test coverage across the scanner, advisor, and audit chain modules
• Zero npm dependencies — the entire backend runs on Node.js stdlib only. No supply chain risk in a security tool.
• Real SHA-256 hash chain — not simulated. Every block is cryptographically linked using Node.js crypto.createHash('sha256') with canonical JSON payload serialization
• 15 OWASP rules in a single pass — the scanner evaluates all rules in one linear scan without multiple regex engines or AST parsers
• Sub-300ms scan response — from POST request to full findings + chain entry in under 300ms
• Kiro spec-first workflow — wrote the full .kiro/specs/codevault.md architecture document before writing a single line of implementation code
• Live in 32 days to deadline — working demo, passing tests, professional dashboard, and recorded video submitted well ahead of Dec 4

What we learned

Kiro's spec-first approach genuinely changes how you build. Writing the .kiro/specs/codevault.md before touching any code forced architectural clarity that saved hours of refactoring later. The steering documents kept the implementation honest.

What's next for CodeVault

Persistent chain storage (LevelDB or SQLite) for cross-session integrity GitHub Action hook for CI/CD pipeline integration Support for Python, Rust, and Go codebases

Built With

• analysis
• css
• html
• ide
• javascript
• kiro
• node.js
• owasp
• security
• sha-256
• static