Open-source AppSec guidance and code analysis for developers who need context before remediation.
NullBreach is an MIT-licensed application-security assistant. Its public, bilingual landing is a static Astro subproject; the authenticated product is a Next.js application with Prisma Postgres, NextAuth, and OpenAI.
- Product
- Architecture
- Public resources
- Discoverability
- Case study
- Quick start
- Quality and security
- Contributing and license
apps/landing/ is a static Astro site for the public /nullbreach and /nullbreach/en routes. It contains the product overview, technical limits, author information, contact details, structured data, canonical URLs, robots directives, and sitemap.
The root Next.js application owns sign-in, registration, password recovery, chat, code analysis, history, Swagger, health, API routes, authentication, and persistence. It is not indexable.
| Surface | Technology | Responsibility |
|---|---|---|
apps/landing/ |
Astro | Static, indexable product landing |
app/, components/ |
Next.js App Router | Authenticated product interface |
app/api/, lib/, prisma/ |
Next.js, Prisma | API boundary, auth, AI, persistence |
.github/workflows/ |
GitHub Actions | Quality, security, and delivery gates |
The shared public contract is https://www.wavival.dev/nullbreach. The build publishes the Astro output as static files in the Next.js deployment, which serves the exact landing paths (/nullbreach, /nullbreach/en, sitemap, and robots) and preserves /nullbreach/:path* for product routes.
- Product: www.wavival.dev/nullbreach
- English landing: www.wavival.dev/nullbreach/en
- Sign in: www.wavival.dev/nullbreach/login
- Spanish sign in: www.wavival.dev/nullbreach/en/login
- Swagger UI: production and local
- OpenAPI document: production and local
- API reference: docs/api.md
- Case study: docs/case-study.md
- Repository: github.com/wavival/nullbreach
- Crawler guidance: robots.txt, sitemap, and llms.txt
The source includes Swagger and OpenAPI routes. The current production deployment returns 404 for them until it is redeployed with the current source.
The public landing is the indexable surface. It has localized canonical and alternate URLs, Open Graph and Twitter metadata, JSON-LD software and website data, a sitemap, robots.txt, and llms.txt.
The authenticated product, API, and Swagger routes are noindex. This keeps indexed content focused on the public explanation of the project while preserving navigable technical documentation for people who need it.
The landing uses semantic landmarks, a skip link, labeled navigation, visible keyboard focus, descriptive image alternative text, image dimensions, lazy loading, and reduced-motion behavior. It is static and contains no runtime secrets or client-side application data fetches.
Read the NullBreach case study for the problem scope, architecture, security boundaries, and public technical resources.
- Node.js 24.x
- npm 11 or newer
- PostgreSQL-compatible
DATABASE_URL
Google sign-in is enabled only when both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are configured. See .env.example for the OAuth callback URLs.
- OpenAI API key for live chat and analysis
git clone git@github.com:wavival/nullbreach.git
cd nullbreach
npm ci
cp .env.example .env.local
npm run db:migrate:deploy
npm run devOpen http://localhost:3000/nullbreach.
npm run landing:devOpen http://localhost:4321/nullbreach.
npm run verify
npm run test:e2e
npm audit --audit-level=criticalnpm run verify includes Astro checks and build, Next.js validation and build, Prisma validation, TypeScript, formatting, linting, and unit coverage. Playwright tests the authenticated product separately.
Read SECURITY.md before reporting a vulnerability. The landing must remain static and free of secrets; the product reads runtime secrets only from server-side environment variables documented in .env.example.
Fork, clone, study, modify, and distribute NullBreach under the MIT License. Contributions follow CONTRIBUTING.md; work branches target dev and advance only after all required checks pass.