Inspiration

A security report is only worth something if people can trust it. Logs and reports can be edited after an incident, by an attacker covering their tracks or by someone who wants a different story. We are a university blockchain team, so we asked: what if an AI analyst's report could be proven untampered?

What it does

VulnPilot is an AI security analyst. You upload an SSH login log (or click the sample) and it:

Detects attacks with plain Python rules: brute force that ended in a successful login, password spraying, and attempts with usernames that do not exist. Every finding keeps the exact log lines as evidence.
Extracts indicators (attacker IPs and users), builds an attack timeline and maps findings to MITRE ATT&CK, then gives an explainable risk score.
Writes an investigation with NVIDIA Nemotron. The AI must quote real log lines, separates confirmed facts from hypotheses, and we check every quote: a claim whose quoted line is not really in the evidence is automatically moved to hypotheses, so the AI cannot invent evidence.
Anchors a SHA-256 fingerprint of the report plus the evidence on the Sepolia blockchain through a small Solidity contract.
Verifies it. A Verify button recomputes the fingerprint and checks the chain. A Tamper test changes one character of the evidence and Verify fails. That is the whole point: proof, not trust.

How we built it

App: Python and Streamlit, pandas, Plotly. Deployed on Streamlit Community Cloud from a public GitHub repo.
AI: NVIDIA Nemotron (Nemotron 3.5 Super) through OpenRouter's free tier, with automatic fallbacks to other free models (Groq, Google) and finally a labelled offline sample, so the app always answers. The code supports Nebius Token Factory as the first choice when a key is available; we could not get Nebius access from Pakistan in time, so the live demo runs on OpenRouter. The UI always shows which model answered.
Blockchain: a tiny Solidity contract (anchor(hash), verify(hash)) on Sepolia, called with web3.py.
Team design: 10 people, most of them beginners. We split the analysis into 12 tiny one-function files with plain instructions, hints and a check script each, so everyone could contribute safely. A pipeline wraps every file in a safety net: if someone's code is unfinished or crashes, the app keeps running with a placeholder and shows its status.

Challenges we ran into

We could not get Nebius or NVIDIA API keys from Pakistan, so we built a provider fallback chain and tested every provider with real keys.
The free reasoning models "thought" for minutes and returned empty answers. Turning reasoning down made answers arrive in seconds.
Keeping an AI honest: we added the quote check so confirmed claims must point to a real log line.
Making a project safe for first-time Python contributors: placeholders, check scripts, and a tidy Git flow. (The GitHub web editor wiped the top of two files before we added guidance!)

Accomplishments we're proud of

A live app where one click shows real findings, a Nemotron-written report, a real Sepolia transaction, and a failing tamper test.
A pipeline where one broken file can never take the whole app down.
Teammates, many writing their first Python, shipped working detectors and parsers that pass the same checks.

What we learned

How to turn an AI answer into something checkable, how a blockchain can act as a trusted clock for a document, and how to organise ten beginners around small, testable pieces with Git.

What's next

More log types (web servers, cloud audit logs), more detection rules, anchoring batches of reports cheaply, and Nebius Token Factory as the default model host.