Polaris

Snapshot of Landing Page

Inspiration

The hackathon theme was Crafting Constellations, and most security tools hand you a flat list of CVEs that nobody reads. We thought about how a scan actually works: you find weak points, and the scary part is how they connect into a path an attacker can walk. That is a constellation. Stars are the findings, the lines between them are the attack. So we built a pentester that draws your attack surface as a star map instead of a table.

What it does

Polaris takes a website or a GitHub repo and points a team of AI agents at it. They run real security tools (semgrep, bandit, trufflehog, nmap, sqlmap and more), an LLM reads the raw output, and it works out how the findings chain together into a MITRE ATT&CK style attack path. All of that is drawn live as a 3D constellation while the scan runs. Every finding is a star, sized and colored by severity. The attack chain is the glowing lines between them. You can orbit around it, hover a star to see the issue, and click it to get the fix.

The part we actually care about: Polaris does not just tell you what is broken, it fixes it. One click and it finds the file behind each finding, rewrites it, and opens a pull request on your repo with a changelog of every edit. The stars it fixed turn green. Nothing touches your main branch, you just review and merge.

How we built it

The frontend is Next.js and React with a Three.js scene for the constellation. The star layout is a hand written force simulation, about 80 lines, no graph library: stars push each other apart, attack paths pull their stars together, everything drifts to the center. A bloom pass makes the dangerous findings glow brighter.

The backend is FastAPI with a LangGraph agent pipeline. A planner looks at the target, picks which scanners to run, each agent runs its tools, an attack chain node reasons over everything, and a report node writes it up. It streams to the frontend over SSE. The fix feature calls the LLM to rewrite the affected files and uses the GitHub API to open the PR. Frontend on Vercel, backend on Render, LLM through Groq.

Challenges we ran into

Getting the live scan to stream without the connection dropping took a few tries, so we built a polling fallback for when the stream dies. The fix-PR feature was the hard one: models return code in a dozen different formats, so we had to make the parser tolerant and add a retry, plus guards that reject a rewrite if it does not parse or looks wrong, and hand it to a human instead of pushing bad code. We also burned real time chasing a bug that turned out to be our LLM endpoint pointing at the wrong provider, which taught us to surface the actual error instead of a generic "it failed."

Accomplishments that we're proud of

The constellation genuinely looks good and it is not fake, every star is real scan data. And the fix actually opens a working pull request, which is the thing most security tools stop short of. Finding the problem is easy, closing it is the hard part, and we did that end to end.

What we learned

How to turn noisy scanner output into something a person can read in one glance. A lot about Three.js and writing a physics sim from scratch. And that the difference between a demo and a product is whether it does the last mile, in our case opening the PR, not just printing advice.

What's next for Polaris

Saved scan history so your past constellations stick around, support for private repos, and deeper fixes for multi file vulnerabilities. Longer term we want the attack chain to simulate what an attacker could reach next, so the constellation predicts the path before it is taken.