BLT-NetGuardian
Official GSoC work-product page for BLT-NetGuardian — final report, archived blog posts, live demo, and source links for evaluators and future reference.
What NetGuardian is
BLT-NetGuardian is a signed findings ingest + org triage path for OWASP BLT, with a researcher-operated Flutter client that does distributed domain discovery from page source. The Worker coordinates the queue and stores findings; it does not fetch third-party sites itself.
client → signed finding → encrypted storage → triage → BLT issue
seed → leased domain queue → spider hosts → scan on client → Sign & send
What shipped
- HMAC-signed, replay-protected ingest (
ztr-finding-1) - AES-256-GCM evidence encryption + redacted decrypt-on-view
- Org-scoped triage UI (filters, risk sort, audit, CSV/PDF, BLT convert)
- HTTP header detection + Semgrep-backed findings
- Flutter client: offline outbox, crawl HUD, shared D1 domain queue
- Site-owner permission outreach (contact discovery, Yes/No + terms)
- Staging deploy, local demo server, docs / quickstart
Primary links
- Upstream repository
- Commit history on main
- Merged merge requests
- Live staging demo
- MR !35 — permission outreach + in-repo final blog
Archived blog posts
Midterm
Zero-trust triage path — signed ingest, encrypted evidence, convert to BLT issue
Final
Full journey — crawl, queue, UX, permission outreach, deployment lessons
Full text also available as markdown: midterm.md · final.md