# mhdsahil1/xerova architecture

> Architecture diagram of the GitHub repository mhdsahil1/xerova, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/mhdsahil1/xerova
- Repository: https://github.com/mhdsahil1/xerova

## Overview

XEROVA is a cybersecurity investigation platform: analysts submit indicators, receive normalized threat findings, and can review activity on the operations dashboard or retain it in reports. Separate capabilities cover URL and QR phishing defense, vulnerability intelligence, live threat feeds, AI-assisted triage, account verification, and the Browser Guard extension. The sampled routes establish several API-to-service and persistence links; README claims support the broader capabilities, but unsampled implementation wiring is not inferred.

Main entry points: [`src/lib/db.ts`](https://github.com/mhdsahil1/xerova/blob/main/src/lib/db.ts) (MongoDB), [`src/app/api/register/route.ts`](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/register/route.ts) (Registration), [`src/app/api/threats/lookup/route.ts`](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/threats/lookup/route.ts) (Indicator lookup), [`src/app/api/dashboard/stats/route.ts`](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/dashboard/stats/route.ts) (Dashboard metrics)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_access["Access and accounts"]
  node_registration["Registration<br/>[route.ts]"]
  node_verification["Email verification<br/>[route.ts]"]
  node_auth["Authentication<br/>[auth.ts]"]
  node_userstore[("User accounts<br/>[User.ts]")]
end

subgraph group_investigation["Threat investigation"]
  node_threatlookup["Indicator lookup<br/>[route.ts]"]
  node_threatengine["Threat intelligence<br/>[threat-apis.ts]"]
  node_threatsearch[("Investigation history<br/>[ThreatSearch.ts]")]
  node_urlapi["URL analysis API<br/>[route.ts]"]
  node_urlengine["URL inspection"]
  node_qr["QR threat scan<br/>[route.ts]"]
  node_vulnapi["CVE search<br/>[route.ts]"]
  node_nvd["NVD integration<br/>[nvd.ts]"]
  node_vendors["Threat data engines<br/>[threat-apis.ts]"]
end

subgraph group_operations["Operations intelligence"]
  node_dashboardapi["Dashboard metrics<br/>[route.ts]"]
  node_newsapi["Cyber news feed<br/>[route.ts]"]
  node_newsservice["News aggregation<br/>[news-api.ts]"]
  node_pulsesapi["Threat pulse feed<br/>[route.ts]"]
  node_pulseservice["Pulse intelligence<br/>[pulsedive.ts]"]
end

subgraph group_assist["AI and reporting"]
  node_assistantapi["Assistant chat<br/>[route.ts]"]
  node_assistantservice["AI assistant<br/>[ai-assistant.ts]"]
  node_aiproviders["AI providers<br/>[gemini.ts]"]
  node_conversation[("Conversations<br/>[Conversation.ts]")]
  node_reportsapi["Report management<br/>[route.ts]"]
  node_reportdetail["Report operations<br/>[route.ts]"]
  node_reportexport["Report export<br/>[route.ts]"]
  node_reportstore[("Investigation reports<br/>[Report.ts]")]
end

subgraph group_extension["Browser Guard"]
  node_extension["Browser Guard<br/>[popup.ts]"]
  node_extensionapi["Extension URL API<br/>[route.ts]"]
end

node_analyst(("Security analyst"))
node_web["Web console<br/>[page.tsx]"]
node_db[("MongoDB<br/>[db.ts]")]
node_nvdexternal["NIST NVD"]
node_externalfeeds["Threat and news services"]
node_gmail["Gmail delivery"]

node_analyst -->|"uses"| node_web
node_analyst -->|"registers"| node_registration
node_registration -->|"creates account"| node_userstore
node_registration -->|"sends verification"| node_gmail
node_analyst -->|"verifies email"| node_verification
node_verification -->|"updates account"| node_userstore
node_analyst -->|"submits indicator"| node_threatlookup
node_threatlookup -->|"dispatches lookup"| node_threatengine
node_threatlookup -->|"records finding"| node_threatsearch
node_threatengine -->|"queries engines"| node_vendors
node_analyst -->|"submits URL"| node_urlapi
node_urlapi -->|"analyzes URL"| node_urlengine
node_analyst -->|"scans QR"| node_qr
node_qr -->|"analyzes destination"| node_urlengine
node_qr -->|"records finding"| node_threatsearch
node_analyst -->|"searches CVEs"| node_vulnapi
node_vulnapi -->|"queries CVEs"| node_nvd
node_nvd -.->|"fetches vulnerability data"| node_nvdexternal
node_web -->|"requests metrics"| node_dashboardapi
node_dashboardapi -->|"aggregates investigations"| node_threatsearch
node_dashboardapi -->|"counts reports"| node_reportstore
node_web -->|"requests news"| node_newsapi
node_newsapi -->|"fetches articles"| node_newsservice
node_newsservice -.->|"queries news service"| node_externalfeeds
node_web -->|"requests pulses"| node_pulsesapi
node_pulsesapi -->|"fetches pulses"| node_pulseservice
node_pulseservice -.->|"queries threat feed"| node_externalfeeds
node_analyst -->|"asks question"| node_assistantapi
node_assistantapi -->|"generates reply"| node_assistantservice
node_assistantapi -->|"stores conversation"| node_conversation
node_assistantservice -->|"requests inference"| node_aiproviders
node_aiproviders -.->|"uses AI services"| node_externalfeeds
node_analyst -->|"creates reports"| node_reportsapi
node_reportsapi -->|"creates report"| node_reportstore
node_analyst -->|"manages report"| node_reportdetail
node_reportdetail -->|"reads and updates"| node_reportstore
node_analyst -->|"exports report"| node_reportexport
node_reportexport -->|"loads report"| node_reportstore
node_extension -.->|"requests URL scan"| node_extensionapi
node_extensionapi -->|"analyzes URL"| node_urlengine
node_registration -->|"connects"| node_db
node_verification -->|"connects"| node_db
node_threatlookup -->|"connects"| node_db
node_dashboardapi -->|"connects"| node_db
node_assistantapi -->|"connects"| node_db
node_reportsapi -->|"connects"| node_db
node_reportdetail -->|"connects"| node_db

click node_web "https://github.com/mhdsahil1/xerova/blob/main/src/app/(dashboard)/dashboard/page.tsx"
click node_registration "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/register/route.ts"
click node_verification "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/verify-email/route.ts"
click node_auth "https://github.com/mhdsahil1/xerova/blob/main/src/lib/auth.ts"
click node_userstore "https://github.com/mhdsahil1/xerova/blob/main/src/models/User.ts"
click node_threatlookup "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/threats/lookup/route.ts"
click node_threatengine "https://github.com/mhdsahil1/xerova/blob/main/src/lib/threat-apis.ts"
click node_threatsearch "https://github.com/mhdsahil1/xerova/blob/main/src/models/ThreatSearch.ts"
click node_urlapi "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/threats/url-analysis/route.ts"
click node_urlengine "https://github.com/mhdsahil1/xerova/blob/main/src/lib/url-analysis-service.ts"
click node_qr "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/threats/qr-scan/route.ts"
click node_vulnapi "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/vulnerabilities/route.ts"
click node_nvd "https://github.com/mhdsahil1/xerova/blob/main/src/lib/nvd.ts"
click node_vendors "https://github.com/mhdsahil1/xerova/blob/main/src/lib/threat-apis.ts"
click node_dashboardapi "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/dashboard/stats/route.ts"
click node_newsapi "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/dashboard/news/route.ts"
click node_newsservice "https://github.com/mhdsahil1/xerova/blob/main/src/lib/news-api.ts"
click node_pulsesapi "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/dashboard/pulses/route.ts"
click node_pulseservice "https://github.com/mhdsahil1/xerova/blob/main/src/lib/pulsedive.ts"
click node_assistantapi "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/assistant/chat/route.ts"
click node_assistantservice "https://github.com/mhdsahil1/xerova/blob/main/src/lib/ai-assistant.ts"
click node_aiproviders "https://github.com/mhdsahil1/xerova/blob/main/src/lib/gemini.ts"
click node_conversation "https://github.com/mhdsahil1/xerova/blob/main/src/models/Conversation.ts"
click node_reportsapi "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/reports/route.ts"
click node_reportdetail "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/reports/%5Bid%5D/route.ts"
click node_reportexport "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/reports/%5Bid%5D/export/route.ts"
click node_reportstore "https://github.com/mhdsahil1/xerova/blob/main/src/models/Report.ts"
click node_extension "https://github.com/mhdsahil1/xerova/blob/main/extension/src/popup/popup.ts"
click node_extensionapi "https://github.com/mhdsahil1/xerova/blob/main/src/app/api/extension/url-analysis/route.ts"
click node_db "https://github.com/mhdsahil1/xerova/blob/main/src/lib/db.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_registration,node_verification,node_auth,node_userstore toneBlue
class node_threatlookup,node_threatengine,node_threatsearch,node_urlapi,node_urlengine,node_qr,node_vulnapi,node_nvd,node_vendors,node_db toneAmber
class node_dashboardapi,node_newsapi,node_newsservice,node_pulsesapi,node_pulseservice toneMint
class node_assistantapi,node_assistantservice,node_aiproviders,node_conversation,node_reportsapi,node_reportdetail,node_reportexport,node_reportstore toneRose
class node_extension,node_extensionapi,node_analyst,node_nvdexternal,node_externalfeeds,node_gmail toneIndigo
class node_web toneTeal
```

## Components

### Access and accounts

- [Registration](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/register/route.ts): `src/app/api/register/route.ts`
- [Email verification](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/verify-email/route.ts): `src/app/api/verify-email/route.ts`
- [Authentication](https://github.com/mhdsahil1/xerova/blob/main/src/lib/auth.ts): `src/lib/auth.ts`
- [User accounts](https://github.com/mhdsahil1/xerova/blob/main/src/models/User.ts): `src/models/User.ts`

### Threat investigation

- [Indicator lookup](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/threats/lookup/route.ts): `src/app/api/threats/lookup/route.ts`
- [Threat intelligence](https://github.com/mhdsahil1/xerova/blob/main/src/lib/threat-apis.ts): `src/lib/threat-apis.ts`
- [Investigation history](https://github.com/mhdsahil1/xerova/blob/main/src/models/ThreatSearch.ts): `src/models/ThreatSearch.ts`
- [URL analysis API](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/threats/url-analysis/route.ts): `src/app/api/threats/url-analysis/route.ts`
- [URL inspection](https://github.com/mhdsahil1/xerova/blob/main/src/lib/url-analysis-service.ts): `src/lib/url-analysis-service.ts`
- [QR threat scan](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/threats/qr-scan/route.ts): `src/app/api/threats/qr-scan/route.ts`
- [CVE search](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/vulnerabilities/route.ts): `src/app/api/vulnerabilities/route.ts`
- [NVD integration](https://github.com/mhdsahil1/xerova/blob/main/src/lib/nvd.ts): `src/lib/nvd.ts`
- [Threat data engines](https://github.com/mhdsahil1/xerova/blob/main/src/lib/threat-apis.ts): `src/lib/threat-apis.ts`

### Operations intelligence

- [Dashboard metrics](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/dashboard/stats/route.ts): `src/app/api/dashboard/stats/route.ts`
- [Cyber news feed](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/dashboard/news/route.ts): `src/app/api/dashboard/news/route.ts`
- [News aggregation](https://github.com/mhdsahil1/xerova/blob/main/src/lib/news-api.ts): `src/lib/news-api.ts`
- [Threat pulse feed](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/dashboard/pulses/route.ts): `src/app/api/dashboard/pulses/route.ts`
- [Pulse intelligence](https://github.com/mhdsahil1/xerova/blob/main/src/lib/pulsedive.ts): `src/lib/pulsedive.ts`

### AI and reporting

- [Assistant chat](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/assistant/chat/route.ts): `src/app/api/assistant/chat/route.ts`
- [AI assistant](https://github.com/mhdsahil1/xerova/blob/main/src/lib/ai-assistant.ts): `src/lib/ai-assistant.ts`
- [AI providers](https://github.com/mhdsahil1/xerova/blob/main/src/lib/gemini.ts): `src/lib/gemini.ts`
- [Conversations](https://github.com/mhdsahil1/xerova/blob/main/src/models/Conversation.ts): `src/models/Conversation.ts`
- [Report management](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/reports/route.ts): `src/app/api/reports/route.ts`
- [Report operations](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/reports/%5Bid%5D/route.ts): `src/app/api/reports/[id]/route.ts`
- [Report export](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/reports/%5Bid%5D/export/route.ts): `src/app/api/reports/[id]/export/route.ts`
- [Investigation reports](https://github.com/mhdsahil1/xerova/blob/main/src/models/Report.ts): `src/models/Report.ts`

### Browser Guard

- [Browser Guard](https://github.com/mhdsahil1/xerova/blob/main/extension/src/popup/popup.ts): `extension/src/popup/popup.ts`
- [Extension URL API](https://github.com/mhdsahil1/xerova/blob/main/src/app/api/extension/url-analysis/route.ts): `src/app/api/extension/url-analysis/route.ts`

### Other components

- **Security analyst**
- [Web console](https://github.com/mhdsahil1/xerova/blob/main/src/app/(dashboard)/dashboard/page.tsx): `src/app/(dashboard)/dashboard/page.tsx`
- [MongoDB](https://github.com/mhdsahil1/xerova/blob/main/src/lib/db.ts): `src/lib/db.ts`
- **NIST NVD**
- **Threat and news services**
- **Gmail delivery**

## Connections

- Security analyst → Web console: uses
- Security analyst → Registration: registers
- Registration → User accounts: creates account
- Registration → Gmail delivery: sends verification
- Security analyst → Email verification: verifies email
- Email verification → User accounts: updates account
- Security analyst → Indicator lookup: submits indicator
- Indicator lookup → Threat intelligence: dispatches lookup
- Indicator lookup → Investigation history: records finding
- Threat intelligence → Threat data engines: queries engines
- Security analyst → URL analysis API: submits URL
- URL analysis API → URL inspection: analyzes URL
- Security analyst → QR threat scan: scans QR
- QR threat scan → URL inspection: analyzes destination
- QR threat scan → Investigation history: records finding
- Security analyst → CVE search: searches CVEs
- CVE search → NVD integration: queries CVEs
- NVD integration → NIST NVD: fetches vulnerability data
- Web console → Dashboard metrics: requests metrics
- Dashboard metrics → Investigation history: aggregates investigations
- Dashboard metrics → Investigation reports: counts reports
- Web console → Cyber news feed: requests news
- Cyber news feed → News aggregation: fetches articles
- News aggregation → Threat and news services: queries news service
- Web console → Threat pulse feed: requests pulses
- Threat pulse feed → Pulse intelligence: fetches pulses
- Pulse intelligence → Threat and news services: queries threat feed
- Security analyst → Assistant chat: asks question
- Assistant chat → AI assistant: generates reply
- Assistant chat → Conversations: stores conversation
- AI assistant → AI providers: requests inference
- AI providers → Threat and news services: uses AI services
- Security analyst → Report management: creates reports
- Report management → Investigation reports: creates report
- Security analyst → Report operations: manages report
- Report operations → Investigation reports: reads and updates
- Security analyst → Report export: exports report
- Report export → Investigation reports: loads report
- Browser Guard → Extension URL API: requests URL scan
- Extension URL API → URL inspection: analyzes URL
- Registration → MongoDB: connects
- Email verification → MongoDB: connects
- Indicator lookup → MongoDB: connects
- Dashboard metrics → MongoDB: connects
- Assistant chat → MongoDB: connects
- Report management → MongoDB: connects
- Report operations → MongoDB: connects