Inspiration
What it does
How we built it
InspirationSmall teams receive noisy security alerts without an analyst who can quickly separate signal from speculation. We built EvidenceFlow to make the first response step safer: explain what is observed, what is inferred, and what still needs verification.## What it doesEvidenceFlow accepts a synthetic alert bundle, normalizes and deduplicates records, validates severity and timestamps, redacts email and token-shaped values, flags prompt-injection-like instructions embedded in log text, and generates an evidence-linked review brief. Every hypothesis includes confidence, evidence references, and next checks. Email, ticket creation, infrastructure changes, and account changes remain blocked behind a human approval gate.## How we built itThe prototype is a self-contained Python standard-library HTTP API with a small browser UI. The core is deterministic for reproducible demos: it produces structured inference from normalized records and keeps model/provider integration behind a bounded interface. The browser uses DOM text construction rather than HTML injection. The API applies request-size limits, JSON validation, safe response headers, and quiet logging so alert contents are not written to logs.## What we learnedGrounding is a product behavior, not a sentence in a prompt. Redaction must happen before export or model boundaries, untrusted alert text must never become instructions, and a useful first version can be safe without pretending to perform remediation.## Challenges and limitationsThe current entry uses synthetic data and a local reasoning fallback. It does not connect to a production SIEM, live CVE service, hosted model, ticketing system, email account, or cloud deployment. Those integrations require separate verification of data terms, credentials, costs, and approval controls. The prototype is intended to show the safety-first workflow and the API/UI boundary, not production readiness.
Challenges we ran into
Accomplishments that we're proud of
What we learned
What's next for EvidenceFlow
Log in or sign up for Devpost to join the conversation.