Inspiration
Small teams often have access logs but limited time to investigate them. A fluent AI explanation is difficult to trust if its evidence is hard to inspect. I built Shahid around a simple principle: evidence before conclusions.
What it does
Shahid is a bilingual web app for reviewing a limited Nginx combined-log format. Rule-based analysis identifies repeated rejected logins, sensitive-path requests and request bursts without calling an AI model.
The user reviews the prepared evidence and explicitly consents before requesting an explanation from NVIDIA Nemotron through Nebius Token Factory. The response presents possible causes, alternative explanations, missing information and suggested manual checks. Clickable evidence IDs highlight parsed events using their original input line numbers.
The interface supports English and Arabic with LTR/RTL layouts. Changing language never automatically calls the model. A legitimate traffic-burst sample demonstrates why crossing a threshold does not establish malicious intent.
Shahid supports manual investigation. Access logs alone do not establish compromise or site safety, and the app does not execute model-written commands or block traffic.
How I built it
The backend uses Python, FastAPI, HTTPX and Pydantic, with an HTML, CSS and JavaScript interface. The deployed backend calls nvidia/nemotron-3-super-120b-a12b through Nebius Token Factory at runtime, requests structured output and checks evidence references before rendering.
Before inference, IP addresses become aliases, and URL queries, referrers and user agents are omitted. Paths and timestamps remain visible in the preview and may still contain sensitive information.
The HTTPS demo runs on an Ubuntu VPS behind Caddy. It includes a private judging-code gate, persistent SQLite attempt counters and bounded requests without automatic retries. The interface displays model identity, token usage and response time.
Challenges I ran into
An initial reasoning-enabled request did not return a complete answer within the output budget. Direct-answer mode made this short structured task practical. Comparing real Arabic responses also exposed language mixing, leading to a narrow rejection check with a clear error instead of a silent retry.
Another challenge was preventing overconfident conclusions. For zero-observation cases, the app now displays a clearly labelled local rule-scope statement rather than a broad model-written claim of safety.
Accomplishments that I'm proud of
I deployed and manually tested real Arabic and English inference with working evidence links. Counters survived a service restart, and a hosted English request deducted one attempt.
The updated source passed 86 local/mocked tests and seven synthetic offline rule/evidence scenarios, with GitHub CI on Python 3.12 and 3.14. These are implementation checks, not measurements of intrusion-detection accuracy or model truthfulness.
What I learned
Schema validation and valid evidence IDs make a response inspectable; they do not prove that every sentence is supported. Useful AI-assisted triage needs visible uncertainty, alternative explanations and human verification, alongside clear boundaries between rule observations and model-written hypotheses.
What's next for Shahid
Expand evaluation beyond synthetic examples, improve Arabic language consistency and add carefully tested support for more log patterns. Keep the workflow focused on evidence review and human decisions.
The live demo requires the access code supplied in the private testing instructions. Judges do not need their own Nebius account or API key.
Log in or sign up for Devpost to join the conversation.