Specter

• 

Inspiration

In 2018, a seemingly harmless npm package called event-stream became one of the most infamous software supply chain attacks in history. A trusted maintainer transferred ownership of the package to a stranger, who silently introduced malicious code through a dependency called flatmap-stream. The backdoor targeted cryptocurrency wallets and remained undetected in production for months.

That incident exposed a harsh reality: developers trust thousands of third-party packages without truly knowing what's running inside them.

Today, supply chain attacks have become one of the fastest-growing cybersecurity threats. While tools like Dependabot notify developers about known CVEs, they rarely explain whether a vulnerability is actually exploitable, how it entered the project, or what its real impact is. Enterprise solutions exist, but they're often too expensive or too complex for students, open-source maintainers, and independent developers.

We built Specter to bridge that gap.

Our vision was simple: turn repository security into something developers can understand visually, explore interactively, and act on immediately.

What it does

Specter is an AI-powered GitHub security intelligence platform that analyzes any public repository in under 10 seconds.

Users simply paste a GitHub repository URL, and Specter launches five security scanners simultaneously.

🕸️ DepChain

Builds the complete dependency graph, resolves the actual installed packages, cross-references every version with known CVEs, and identifies exactly where vulnerabilities enter the dependency chain.

👻 GhostCommit

Scans the repository's entire Git history using entropy analysis to discover leaked secrets—even credentials that were removed from the latest commit but still exist in previous revisions.

🐳 LayerScan

Analyzes Dockerfiles for security misconfigurations including root containers, outdated base images, exposed ports, and insecure build practices.

🔓 APIBleed

Inspects backend routes to identify APIs missing authentication, authorization, or proper access control.

🔑 EnvTrace

Detects accidentally committed .env files, API keys, tokens, certificates, and other sensitive configuration data.

Instead of overwhelming developers with long vulnerability tables, Specter visualizes the repository as an interactive 3D security graph.

Node size represents vulnerability severity. Particle flows show real attack paths. Timeline spikes indicate when secrets were introduced. Dependency relationships reveal the blast radius of compromised packages.

An integrated AI assistant transforms technical findings into plain English by explaining:

why an issue is dangerous, whether it is exploitable, what impact it can have, and the exact steps required to fix it.

Developers can also export a professional PDF security report or automate repository monitoring through n8n workflows that notify teams instantly whenever new risks are detected.

How we built it

Specter combines modern web technologies, static analysis, AI, and cybersecurity into a unified security platform.

Frontend React TypeScript Tailwind CSS Three.js React Three Fiber Backend Node.js Express.js GitHub REST API Worker Threads for parallel scanning Security Engine npm dependency resolution OSV/NVD CVE databases Git history analysis Entropy-based secret detection Dockerfile parser Static API route analysis AI Layer Large Language Model for vulnerability explanations Threat prioritization Remediation guidance Risk summaries Reporting & Automation PDF report generation n8n workflow integration Telegram notifications GitHub webhook support

To maximize speed, all five scanners execute independently in parallel. Even if one scanner encounters an error, the remaining modules continue processing, ensuring developers always receive meaningful results instead of failed scans.

Challenges we ran into

One of our biggest challenges was ensuring the visualization communicated real information instead of becoming a flashy animation. Every visual element had to correspond to actual security data. Node sizes represent CVE severity, attack paths only appear when vulnerabilities genuinely propagate through dependencies, and timeline spikes map precisely to the commits where secrets were introduced.

Another challenge was reducing false positives. Simply matching package names against CVE databases creates excessive noise. We instead resolved the full dependency tree, verified installed package versions, and checked them against affected version ranges so developers only see vulnerabilities that truly impact their project.

Scanning Git history presented another obstacle. Secrets often remain recoverable long after being deleted from the latest commit. GhostCommit traverses every commit and analyzes each diff using entropy detection while caching GitHub API responses to remain performant under rate limits.

Running five independent scanners simultaneously also required careful orchestration. We designed a fault-tolerant pipeline where each scanner executes independently. If one module fails, the rest still complete successfully, allowing Specter to generate a meaningful threat assessment rather than failing entirely.

Finally, live demonstrations introduced the risk of network failures and GitHub API limits. To ensure reliable presentations, we recreated the complete 2018 event-stream attack using a scripted dataset while preserving a fully functional live scanning mode for real repositories.

Accomplishments that we're proud of

Built a complete repository security platform capable of analyzing repositories in under 10 seconds. Successfully integrated five independent security scanners into a unified workflow. Created an interactive 3D visualization that transforms complex security relationships into intuitive insights. Developed an AI assistant that converts raw vulnerability data into actionable remediation guidance. Implemented historical secret detection across entire Git commit histories instead of only the latest revision. Designed a resilient parallel scanning architecture capable of handling partial failures gracefully. Produced exportable professional security reports suitable for developers and teams. Demonstrated how cybersecurity can become more visual, understandable, and accessible to every developer—not just security experts.

What we learned

Building Specter taught us that cybersecurity is not only about detecting vulnerabilities—it is about helping developers understand them.

We learned how to process large dependency graphs efficiently, analyze Git history at scale, reduce false positives through version-aware vulnerability matching, orchestrate parallel scanning pipelines, and design visualizations that communicate meaningful security insights instead of overwhelming users with data.

Most importantly, we discovered that AI is most valuable when it explains complex technical findings in a way developers can immediately understand and act upon.

What's next for Specter

Specter is just the beginning.

Our roadmap includes:

Real-time GitHub Pull Request scanning before code is merged. GitHub Actions integration for continuous security monitoring. Support for Python, Java, Go, Rust, and other ecosystems beyond npm. Runtime reachability analysis to determine whether vulnerable code is actually executable. AI-generated pull requests that automatically remediate security issues. Software Bill of Materials (SBOM) generation for compliance. License compatibility analysis. Team dashboards with historical security trends. Organization-wide monitoring across multiple repositories. Predictive AI models capable of identifying risky dependencies before public CVEs are published.

Our long-term mission is to make repository security fast, visual, intelligent, and accessible to every developer, helping prevent the next supply chain attack before it reaches production.

Built With

• n8n
• node.js
• react
• supabase
• typescript
• vercel