$ show berylliumsec/nebula
Nebula is a local-first security assessment workbench designed for penetration testing and red teaming operations. It functions as a desktop application built with a Tauri shell (Rust) wrapping a React/TypeScript frontend and a Python FastAPI backend sidecar. The system manages security engagements, scope policies, evidence collection, and AI-assisted analysis, emphasizing operator control, auditability, and data privacy through local-first execution and content-addressed artifact storage. The architecture follows a sidecar pattern where the Python Core service handles database operations (SQLite with Alembic), containerized command execution (Kali Linux via Docker/Podman), and AI provider integration. The frontend manages the UI state and terminal sessions via WebSocket. Key data flows involve user actions triggering API calls that validate against scope policies before executing commands in isolated containers, with all outputs stored as immutable artifacts for evidence integrity. The codebase demonstrates strong engineering practices with extensive test coverage (Pytest, Vitest, Playwright), a robust diagnostic system with secret redaction, and a policy engine for deterministic scope enforcement. It supports multiple AI providers and includes features for knowledge indexing, mission orchestration, and report generation. The project is actively maintained with recent commits and zero security alerts, though it is currently in alpha release.
The LLM identified 5 files worth highlighting for reuse:
Implements a content-addressed artifact store using SHA-256 hashing for evidence integrity. This component allows safe extraction of immutable storage logic for any application requiring verifiable data provenance, demonstrating non-obvious skill in cryptographic verification and atomic file operations.
Contains the PolicyEngine class that evaluates requests against frozen scope policies (CIDRs, domains, ports) before execution. This is a reusable pattern for security-critical applications requiring strict boundary enforcement, demonstrating complex network scope logic and approval workflows.
Provides a centralized diagnostic system with automatic secret redaction and schema validation. The component encapsulates logging logic that prevents credential leakage while preserving stack traces, a reusable pattern for secure application monitoring and incident resolution.
Implements context compaction logic for LLM sessions, managing token limits and creating immutable snapshots with provenance references. This demonstrates advanced memory management for AI applications, allowing extraction of context handling patterns for other LLM-integrated systems.
Manages containerized execution with strict isolation, including network egress control and capability drops. This component abstracts Podman/Docker differences for secure command execution, offering a reusable pattern for sandboxed environments in security tools.