# fariddevu/netsentinel architecture

> Architecture diagram of the GitHub repository fariddevu/netsentinel, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-19). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/fariddevu/netsentinel
- Repository: https://github.com/fariddevu/netsentinel

## Overview

1. **Repository shape**
   - This is a three-runtime system: a desktop client in **Angular + Electron**, a **Spring Boot** API backend in **Java 21**, and a **Rust sandbox service** that runs security tools inside **Kali Linux on WSL2**.
   - The architecture is intentionally split so the UI stays local-first, the backend owns state and analysis, and the sandbox is the only component that can invoke external scanning tools.

2. **Desktop application boundary**
   - The `frontend/` folder contains the user-facing app.
   - **Angular** implements the screens for scan setup, dashboard, assets, results, history, comparison, tutorial, credits, and agent chat.
   - **Electron** is the desktop shell: it bridges the renderer to the backend, likely handles startup/bootstrap, and packages the app for Windows distribution.

3. **Backend boundary and responsibilities**
   - The `backend/` folder is the central coordinator.
   - It exposes a **local REST API on port 8080**, validates requests, starts and tracks scans, persists results, performs analysis, exports reports, serves dashboard/history data, and mediates access to the sandbox.
   - The backend is organized in the standard Spring layers: `controller` for HTTP, `service` for business logic, `repository` for persistence, `entity` for database models, `dto` for API payloads, and `config`/`exception` for cross-cutting concerns.

4. **Scan execution flow**
   - A scan begins from the frontend through Electron to the backend endpoint `POST /api/scan/start`.
   - The backend creates a `ScanJob`, validates the target/profile, then calls the Rust sandbox using an authenticated request.
   - The sandbox runs tools such as **Nmap**, **Gobuster**, and **Nikto** inside Kali/WSL2, returns raw findings, and the backend parses and stores the results.
   - The frontend polls scan status and later fetches full results, logs, or exports.

5. **Sandbox boundary**
   - The `sandbox/` service is a separate Rust process using **Axum/Tokio**.
   - Its job is deliberately narrow: validate commands and targets, authenticate backend requests with a token/header, and execute only approved tool invocations.
   - This is the trust boundary that isolates the dangerous part of the system from the backend and desktop UI.

6. **Analysis and normalization pipeline**
   - Once raw scanner output returns, backend services like `NmapParserService`, `NiktoParserService`, and `GobusterParserService` normalize it into domain objects.
   - `AnalysisService` then performs deterministic security analysis, calculates a risk score, and generates plain-language remediation guidance in Spanish.
   - This means the product’s “diagnosis” is not just a view of raw tool output; it is a second-stage interpretation layer.

7. **Persistence model**
   - The backend persists scan state and findings in **PostgreSQL**, with schema managed by **Flyway** migrations under `backend/src/main/resources/db/migration`.
   - Core entities include scan jobs, network hosts, ports, CVE entries, web findings, and finding status records.
   - Repositories provide database access for scan history, asset inventory, CVE lookup, and user-updated finding states.

8. **CVE correlation and asset inventory**
   - `NvdService` connects detected services/versions to the **NVD/NIST CVE source** so findings can be enriched with known vulnerabilities.
   - `NetworkService` and `AssetService` shape discovered hosts and ports into the asset inventory and dashboard views.
   - This is the main data enrichment path: scan output becomes structured assets plus vulnerability context.

9. **Exports, history, and comparison**
   - `ExportService` and `ScanCompareService` support report generation and scan-to-scan comparison.
   - The backend includes a Thymeleaf-style report template at `templates/report.html`, which likely feeds PDF generation alongside JSON and CSV exports.
   - History and comparison endpoints depend on the persisted scan graph, not on live sandbox execution.

10. **Dashboard and user-facing workflow**
   - The dashboard view is a summary layer built from backend aggregates, not a separate data source.
   - The frontend pages for results, assets, history, and comparison are all consumers of the same scan datastore and analysis pipeline.
   - The user journey is: install once, start a scan, wait for completion, review risk and findings, then export or compare.

11. **Agent subsystem**
   - The project also includes an optional **Claude-based agent** exposed at `/api/agent/chat`.
   - This is separate from the deterministic scanner: it acts as a conversational orchestrator that can drive tools, inspect results, and guide the user via SSE streaming.
   - Architecturally, it is an auxiliary control plane on top of the scan system, not the primary source of truth.

12. **Operational concerns and cross-cutting config**
   - `SecurityConfig`, `TraceIdFilter`, `AsyncConfig`, and the custom health indicator show that the backend is designed for local orchestration, tracing, async processing, and health checks of backend/db/sandbox dependencies.
   - `application-risks.yml` and `RiskCatalogProperties` indicate configurable scoring or recommendation rules.
   - Errors are normalized through `GlobalExceptionHandler` into API-friendly responses.

13. **Tests and delivery**
   - The repo is designed to be built and tested as three components: backend Maven tests, sandbox Cargo tests, and frontend Angular tests.
   - GitHub Actions (`.github/workflows/ci.yml`) runs the full suite, reinforcing the modular boundaries between UI, API, and sandbox.
   - Packaging targets Windows desktop distribution via Electron/NSIS, with WSL2/Kali installed as part of the guided setup.

Main entry points: [`frontend/src/app/services/scan.service.ts`](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/services/scan.service.ts) (Scan service), [`frontend/src/app/app.routes.ts`](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/app.routes.ts) (App routes), [`sandbox/src/main.rs`](https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/main.rs) (Sandbox API), [`backend/src/main/java/com/netsentinel/service/ScanService.java`](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/ScanService.java) (Scan engine)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["Desktop client"]
  node_electron_shell["Electron shell<br/>desktop host<br/>[main.ts]"]
  node_electron_bridge["Preload bridge<br/>renderer bridge<br/>[preload.ts]"]
  node_app_routes["App routes<br/>ui routing<br/>[app.routes.ts]"]
  node_scan_page["Scan setup<br/>ui page<br/>[scan.ts]"]
  node_dashboard_page["Dashboard<br/>ui page<br/>[dashboard.ts]"]
  node_results_page["Results<br/>ui page<br/>[results.ts]"]
  node_assets_page["Assets<br/>ui page<br/>[assets.ts]"]
  node_history_page["History<br/>ui page<br/>[history.ts]"]
  node_compare_page["Compare<br/>ui page<br/>[compare.ts]"]
  node_agent_page["Agent chat<br/>ui page<br/>[agent.ts]"]
  node_scan_client["Scan service<br/>api client<br/>[scan.service.ts]"]
end

subgraph group_backend["API backend"]
  node_boot["Spring boot<br/>backend entry"]
  node_scan_api["Scan API<br/>http controller"]
  node_core_scan["Scan engine<br/>workflow service<br/>[ScanService.java]"]
  node_sandbox_client["Sandbox client<br/>integration service"]
  node_analysis["Analysis"]
  node_parsers["Parsers<br/>output normalization"]
  node_enrichment["CVE enrichment<br/>vuln intel<br/>[NvdService.java]"]
  node_inventory["Asset inventory<br/>host/port modeling"]
  node_dashboard["Dashboard data<br/>aggregates service"]
  node_compare["Scan compare<br/>diff service"]
  node_export["Export reports<br/>report service<br/>[ExportService.java]"]
  node_scan_job[("Scan jobs<br/>domain model<br/>[ScanJob.java]")]
  node_scan_repo["Scan repo<br/>persistence"]
  node_report_tpl["Report template<br/>[report.html]"]
end

subgraph group_sandbox["Sandbox service"]
  node_sandbox_main["Sandbox API<br/>rust service<br/>[main.rs]"]
  node_sandbox_valid["Command guard<br/>validation<br/>[validator.rs]"]
  node_sandbox_exec["Tool runner<br/>executor<br/>[executor.rs]"]
  node_sandbox_models["Sandbox models<br/>rust types<br/>[models.rs]"]
end

subgraph group_delivery["Delivery"]
  node_ci["CI pipeline<br/>automation<br/>[ci.yml]"]
end

node_electron_shell -->|"IPC"| node_electron_bridge
node_app_routes -->|"navigates"| node_scan_page
node_app_routes -->|"navigates"| node_dashboard_page
node_app_routes -->|"navigates"| node_results_page
node_app_routes -->|"navigates"| node_assets_page
node_app_routes -->|"navigates"| node_history_page
node_app_routes -->|"navigates"| node_compare_page
node_app_routes -->|"navigates"| node_agent_page
node_scan_page -->|"starts scan"| node_scan_client
node_dashboard_page -->|"loads summary"| node_scan_client
node_results_page -->|"fetches results"| node_scan_client
node_assets_page -->|"loads assets"| node_scan_client
node_history_page -->|"loads history"| node_scan_client
node_compare_page -->|"compares scans"| node_scan_client
node_agent_page -->|"chat tools"| node_scan_client
node_scan_client -->|"http via shell"| node_electron_bridge
node_electron_shell -->|"local API"| node_scan_api
node_boot -->|"hosts"| node_scan_api
node_scan_api -->|"delegates"| node_core_scan
node_core_scan -->|"invokes"| node_sandbox_client
node_core_scan -->|"creates job"| node_scan_job
node_core_scan -->|"normalizes output"| node_parsers
node_parsers -->|"feeds findings"| node_analysis
node_analysis -->|"correlates CVEs"| node_enrichment
node_analysis -->|"updates inventory"| node_inventory
node_inventory -->|"summarizes"| node_dashboard
node_dashboard -->|"serves"| node_dashboard_page
node_analysis -->|"exports"| node_export
node_export -->|"renders"| node_report_tpl
node_compare -->|"uses history"| node_history_page
node_scan_repo -->|"persists"| node_scan_job
node_sandbox_main -->|"guards"| node_sandbox_valid
node_sandbox_main -->|"dispatches"| node_sandbox_exec
node_sandbox_main -->|"serializes"| node_sandbox_models
node_sandbox_client -->|"authenticated call"| node_sandbox_main
node_ci -->|"tests"| node_boot
node_ci -->|"tests"| node_sandbox_main
node_ci -->|"tests"| node_scan_client

click node_electron_shell "https://github.com/fariddevu/netsentinel/blob/master/frontend/electron/main.ts"
click node_electron_bridge "https://github.com/fariddevu/netsentinel/blob/master/frontend/electron/preload.ts"
click node_app_routes "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/app.routes.ts"
click node_scan_page "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/scan/scan.ts"
click node_dashboard_page "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/dashboard/dashboard.ts"
click node_results_page "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/results/results.ts"
click node_assets_page "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/assets/assets.ts"
click node_history_page "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/history/history.ts"
click node_compare_page "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/compare/compare.ts"
click node_agent_page "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/agent/agent.ts"
click node_scan_client "https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/services/scan.service.ts"
click node_boot "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/NetSentinelApplication.java"
click node_scan_api "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/controller/ScanController.java"
click node_core_scan "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/ScanService.java"
click node_sandbox_client "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/SandboxService.java"
click node_analysis "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/AnalysisService.java"
click node_parsers "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/NmapParserService.java"
click node_enrichment "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/NvdService.java"
click node_inventory "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/NetworkService.java"
click node_dashboard "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/DashboardService.java"
click node_compare "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/ScanCompareService.java"
click node_export "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/ExportService.java"
click node_scan_job "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/entity/ScanJob.java"
click node_scan_repo "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/repository/ScanJobRepository.java"
click node_report_tpl "https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/resources/templates/report.html"
click node_sandbox_main "https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/main.rs"
click node_sandbox_valid "https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/validator.rs"
click node_sandbox_exec "https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/executor.rs"
click node_sandbox_models "https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/models.rs"
click node_ci "https://github.com/fariddevu/netsentinel/blob/master/.github/workflows/ci.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_electron_shell,node_electron_bridge,node_app_routes,node_scan_page,node_dashboard_page,node_results_page,node_assets_page,node_history_page,node_compare_page,node_agent_page,node_scan_client toneBlue
class node_boot,node_scan_api,node_core_scan,node_sandbox_client,node_analysis,node_parsers,node_enrichment,node_inventory,node_dashboard,node_compare,node_export,node_scan_job,node_scan_repo,node_report_tpl toneAmber
class node_sandbox_main,node_sandbox_valid,node_sandbox_exec,node_sandbox_models toneMint
class node_ci toneRose
```

## Components

### Desktop client

Angular UI packaged with Electron for local-first desktop use.

- [Electron shell](https://github.com/fariddevu/netsentinel/blob/master/frontend/electron/main.ts): desktop host · Desktop process that boots the app and mediates local runtime startup. · `frontend/electron/main.ts`
- [Preload bridge](https://github.com/fariddevu/netsentinel/blob/master/frontend/electron/preload.ts): renderer bridge · Secure IPC boundary between Angular renderer and Electron. · `frontend/electron/preload.ts`
- [App routes](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/app.routes.ts): ui routing · Top-level Angular navigation across scan, results, history, compare, and agent views. · `frontend/src/app/app.routes.ts`
- [Scan setup](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/scan/scan.ts): ui page · Entry point for configuring and starting a scan. · `frontend/src/app/pages/scan/scan.ts`
- [Dashboard](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/dashboard/dashboard.ts): ui page · Summary view built from backend aggregates. · `frontend/src/app/pages/dashboard/dashboard.ts`
- [Results](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/results/results.ts): ui page · Detailed findings and scan output review. · `frontend/src/app/pages/results/results.ts`
- [Assets](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/assets/assets.ts): ui page · Inventory view for discovered hosts and ports. · `frontend/src/app/pages/assets/assets.ts`
- [History](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/history/history.ts): ui page · Past scan list and status timeline. · `frontend/src/app/pages/history/history.ts`
- [Compare](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/compare/compare.ts): ui page · Scan-to-scan comparison view. · `frontend/src/app/pages/compare/compare.ts`
- [Agent chat](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/pages/agent/agent.ts): ui page · Conversational control surface for the assistant workflow. · `frontend/src/app/pages/agent/agent.ts`
- [Scan service](https://github.com/fariddevu/netsentinel/blob/master/frontend/src/app/services/scan.service.ts): api client · Frontend HTTP client used to start scans and poll status/results. · `frontend/src/app/services/scan.service.ts`

### API backend

Spring Boot service that owns scans, analysis, persistence, and exports.

- [Spring boot](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/NetSentinelApplication.java): backend entry · Application bootstrap and assembly root. · `backend/src/main/java/com/netsentinel/NetSentinelApplication.java`
- [Scan API](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/controller/ScanController.java): http controller · REST endpoints for scan lifecycle and status. · `backend/src/main/java/com/netsentinel/controller/ScanController.java`
- [Scan engine](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/ScanService.java): workflow service · Validates targets, creates jobs, calls the sandbox, and tracks execution. · `backend/src/main/java/com/netsentinel/service/ScanService.java`
- [Sandbox client](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/SandboxService.java): integration service · Authenticated backend integration to the Rust sandbox. · `backend/src/main/java/com/netsentinel/service/SandboxService.java`
- [Analysis](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/AnalysisService.java): security analysis · Normalizes findings, computes risk, and generates remediation guidance. · `backend/src/main/java/com/netsentinel/service/AnalysisService.java`
- [Parsers](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/NmapParserService.java): output normalization · Tool-specific parsers for Nmap, Nikto, and Gobuster output. · `backend/src/main/java/com/netsentinel/service/NmapParserService.java`
- [CVE enrichment](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/NvdService.java): vuln intel · Maps detected services and versions to NVD-backed vulnerability data. · `backend/src/main/java/com/netsentinel/service/NvdService.java`
- [Asset inventory](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/NetworkService.java): host/port modeling · Shapes discovered hosts and ports into the inventory model. · `backend/src/main/java/com/netsentinel/service/NetworkService.java`
- [Dashboard data](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/DashboardService.java): aggregates service · Builds dashboard and history summaries from persisted scan state. · `backend/src/main/java/com/netsentinel/service/DashboardService.java`
- [Scan compare](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/ScanCompareService.java): diff service · Compares scans using persisted results and analysis artifacts. · `backend/src/main/java/com/netsentinel/service/ScanCompareService.java`
- [Export reports](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/service/ExportService.java): report service · Generates JSON, CSV, and template-based reports. · `backend/src/main/java/com/netsentinel/service/ExportService.java`
- [Scan jobs](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/entity/ScanJob.java): domain model · Persisted scan state and lifecycle record. · `backend/src/main/java/com/netsentinel/entity/ScanJob.java`
- [Scan repo](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/java/com/netsentinel/repository/ScanJobRepository.java): persistence · Database access for scan jobs and history. · `backend/src/main/java/com/netsentinel/repository/ScanJobRepository.java`
- [Report template](https://github.com/fariddevu/netsentinel/blob/master/backend/src/main/resources/templates/report.html): template · HTML report template used for export generation. · `backend/src/main/resources/templates/report.html`

### Sandbox service

Rust service that runs approved security tools inside Kali on WSL2.

- [Sandbox API](https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/main.rs): rust service · Axum/Tokio service that exposes the narrow tool-execution boundary. · `sandbox/src/main.rs`
- [Command guard](https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/validator.rs): validation · Validates targets and approved tool commands. · `sandbox/src/validator.rs`
- [Tool runner](https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/executor.rs): executor · Runs approved scanner invocations inside the sandbox. · `sandbox/src/executor.rs`
- [Sandbox models](https://github.com/fariddevu/netsentinel/blob/master/sandbox/src/models.rs): rust types · Shared request and response types for sandbox execution. · `sandbox/src/models.rs`

### Delivery

Build, packaging, and CI automation.

- [CI pipeline](https://github.com/fariddevu/netsentinel/blob/master/.github/workflows/ci.yml): automation · Cross-component build and test workflow. · `.github/workflows/ci.yml`

## Connections

- Electron shell → Preload bridge: IPC · Renderer access is mediated through the preload bridge.
- App routes → Scan setup: navigates · Routes surface the scan setup experience.
- App routes → Dashboard: navigates · Routes surface dashboard views.
- App routes → Results: navigates · Routes surface result review.
- App routes → Assets: navigates · Routes surface asset inventory.
- App routes → History: navigates · Routes surface scan history.
- App routes → Compare: navigates · Routes surface scan comparison.
- App routes → Agent chat: navigates · Routes surface the assistant chat.
- Scan setup → Scan service: starts scan · UI delegates scan initiation to the HTTP client.
- Dashboard → Scan service: loads summary · Dashboard consumes aggregated backend data.
- Results → Scan service: fetches results · Results view reads scan details and status.
- Assets → Scan service: loads assets · Asset inventory is fetched from backend APIs.
- History → Scan service: loads history · History view reads persisted scan records.
- Compare → Scan service: compares scans · Comparison view uses backend diff endpoints.
- Agent chat → Scan service: chat tools · Agent UI communicates with the backend assistant endpoint.
- Scan service → Preload bridge: http via shell · Desktop client traffic is initiated from the packaged app boundary.
- Electron shell → Scan API: local API · Electron app talks to the backend REST service on localhost.
- Spring boot → Scan API: hosts · Application bootstrap wires the HTTP controllers.
- Scan API → Scan engine: delegates · Scan controller forwards lifecycle actions to the scan engine.
- Scan engine → Sandbox client: invokes · Backend hands approved execution to the sandbox boundary.
- Scan engine → Scan jobs: creates job · Scan execution begins with persisted job state.
- Scan engine → Parsers: normalizes output · Raw tool output is parsed into domain findings.
- Parsers → Analysis: feeds findings · Normalized output is analyzed for risk and remediation.
- Analysis → CVE enrichment: correlates CVEs · Analysis is enriched with vulnerability intelligence.
- Analysis → Asset inventory: updates inventory · Detected hosts and ports become asset inventory.
- Asset inventory → Dashboard data: summarizes · Inventory and scan data feed dashboard aggregates.
- Dashboard data → Dashboard: serves · Backend summary data powers the dashboard UI.
- Analysis → Export reports: exports · Analysis results are rendered into downloadable reports.
- Export reports → Report template: renders · Template-based report generation uses the HTML template.
- Scan compare → History: uses history · Comparison relies on persisted scan history.
- Scan repo → Scan jobs: persists · Repository stores scan job state.
- Sandbox API → Command guard: guards · Sandbox requests are checked before execution.
- Sandbox API → Tool runner: dispatches · Validated requests are executed by the runner.
- Sandbox API → Sandbox models: serializes · Request and response models define the sandbox API.
- Sandbox client → Sandbox API: authenticated call · Backend invokes the sandbox over a narrow trusted interface.
- CI pipeline → Spring boot: tests · Workflow builds and tests the backend.
- CI pipeline → Sandbox API: tests · Workflow builds and tests the Rust sandbox.
- CI pipeline → Scan service: tests · Workflow runs frontend validation and tests.