Case Study · Full-Stack Security Product · Oct 2026
Aegis — Personal Cyber Defense Platform
Most people are not compromised by nation-state zero-days. They are compromised by a phishing link in an SMS, a fake “verify your account” email, a malware attachment disguised as an invoice, or a weak password that leaked in someone else's breach. Aegis gives a non-technical user one place to check each of these before it hurts them — and the platform itself is hardened against the OWASP Top 10.
The ten protection modules
1. Phishing URL Analyser
Detects IP-literal hosts, punycode and homograph domains, typosquatting against known brands (including Indian banks and UPI), brand-in-host tricks, URL shorteners, credential keywords and DGA-like entropy — returned as explained, weighted findings, not a bare score.
2. Phishing & BEC Email Analyser
Checks SPF/DKIM/DMARC failures, Reply-To and Return-Path mismatches, display-name spoofing, urgency and pressure language, and link-text versus destination mismatches — then re-scores every link in the email with the URL analyser.
3. Malware File Scanner
Static analysis only: magic-byte type spoofing, double extensions, dangerous file types, Shannon entropy for packers, embedded droppers and macro auto-exec markers. Files are scanned in memory — never executed, never written to disk.
4. Password Lab & Breach Check
Entropy and offline crack-time estimation, common-password detection, and a secure generator built on Python's secrets module with diceware-style passphrases — plus Have-I-Been-Pwned breach lookups using k-anonymity: only the first five hex characters of the password's SHA-1 hash ever leave the machine.
5. Encrypted Vault
AES-256-GCM authenticated encryption with keys derived from the user's master password via Argon2id. The server stores ciphertext only — a database leak reveals nothing, and tampering is caught by the GCM tag.
6. Website Security Audit
Grades any site A–F on HTTPS/HSTS, CSP, X-Frame-Options, MIME-sniffing protection, Referrer/Permissions policies and cookie flags.
7. Scam Message Checker
Built for the scams Indians actually receive: digital-arrest and agency impersonation, KYC and account-block threats, OTP harvesting, UPI redirection and Telegram task scams — and it re-scores every link inside the message.
8. Domain Security Checker
Live DNS grading of the records that stop email spoofing: SPF, DMARC policy strength, and CAA.
9. TLS Certificate Inspector
Real TLS handshakes covering chain verification, hostname coverage, expiry runway and protocol version — including an unverified re-handshake so broken certificates are reported, not hidden.
10. Secret Scanner
Finds leaked credentials in text and config files: provider API-key formats, high-entropy assignments, Luhn-valid card numbers and recovery seed phrases. Findings are scored and shown masked only — the secret itself is never echoed back in full.
Architecture
A React/TypeScript single-page app served with a FastAPI backend, containerised with Docker. Every analysis is streamed to the browser stage-by-stage over Server-Sent Events, so the user watches each check execute and the running risk score build — the streamed result is byte-for-byte identical to the classic API result, a parity enforced by tests. Every finding in every report ships with a concrete suggested fix written for the person holding the report; a test enforces that no finding can ship without one.
How Aegis secures itself
Parameterised SQLAlchemy queries and Pydantic validation on every request body. JWT required on protected routes, with per-user row scoping on every query. Argon2id password hashing with a 12-character minimum, account lockout after five failed attempts, and generic authentication errors that never reveal whether an account exists. Short-lived access tokens; secrets come from the environment only. Rate limiting is enforced globally and more strictly on authentication endpoints. Outbound fetches are restricted to public http/https targets with timeouts, blocking SSRF against private and loopback addresses. CORS is allowlisted, a strict CSP and security-headers middleware are applied, and Dependabot, Bandit, CodeQL and npm audit run in CI.
My role
Designed and built end-to-end by Manoj Kumar Sharma — threat model, detection logic, backend, frontend, Docker deployment and CI. Verified with an automated test suite, GitHub Actions CI and CodeQL, all passing; the demo runs live on Render.