NullBreach

The developer pastes a code snippet and gets an immediate diagnosis against OWASP Top 10. They can keep asking in an AI chat that remembers the thread, without repeating context or switching between tools.

By Valentina Ramírez · Updated: June 16, 2026

View live site View repo

Summary

Full stack app: paste a code snippet and get an immediate OWASP Top 10 diagnosis, with a persistent-context AI chat (Claude API). Django, DRF, PostgreSQL, React, Astro.

Stack

DjangoDRFPostgreSQLJWTClaude APIReactTypeScriptAstro

The problem

Reviewing code with OWASP criteria or resolving a specific cybersecurity question means jumping between heavy scanners, scattered documentation, and outdated forums.

Scanners with a steep curve

Semgrep or SonarQube solve a lot, but setting up and tuning the rules costs time a quick question does not justify.

Scattered answers

Guidance is spread across dense documentation and forums that age badly.

No memory of the analysis

The tools do not converse: every new question forces re-explaining the code.

What I built

01
Static code fragment analysis engine: detects SQL injection, XSS, hardcoded secrets, insecure error handling, and other OWASP Top 10 vulnerabilities.
02
Integrated AI chat via Claude API with persistent conversation context and per-user history stored in the database.
03
JWT authentication with protected endpoints; paginated responses.
04
Decoupled architecture: backend in Django REST Framework + PostgreSQL, frontend in Astro + React + TypeScript.

OWASP analysis

Paste a snippet and get a diagnosis against the OWASP Top 10 on the spot.

Chat with memory

Ask follow-ups without repeating the code: the chat retains the analysis thread.

Structured diagnosis

Each finding carries an OWASP category, severity, and a remediation recommendation.

Public API

The backend is open at github.com/wavival/nullbreach-api.

Architecture decisions

1. Claude API vs traditional static analysis

Context: Traditional SAST tools (Semgrep, SonarQube) match patterns but do not explain the why or reason about code outside their rules.
Trade-off: A rule engine is deterministic and fast but rigid: it does not generalize to new code or give an actionable explanation.
Decision: Claude API brings structured reasoning over the snippet: it classifies against OWASP Top 10, explains the cause, and proposes the fix. Deterministic analysis stays for what it asserts with certainty; the model adds the reasoning, labeled as such.

2. Persistent chat context

Context: Security questions have context: a developer does not repeat the full background on every message.
Trade-off: Stateless chat is simpler but forces the user to repeat context and breaks the analysis thread.
Decision: Conversation history stored in the database and sent as context on each request. The model remembers the thread without the user repeating it.

3. JWT to isolate analysis sessions

Context: Each user analyzes potentially sensitive code; their sessions and history cannot mix.
Trade-off: Cookie sessions are convenient but couple the decoupled frontend and backend and complicate per-user isolation.
Decision: JWT authentication with protected endpoints: each analysis and history is isolated per user, fits the decoupled backend, and assumes no shared session state.

4. Astro for the frontend

Context: NullBreach's frontend is mostly content and analysis forms, not a heavy SPA.
Trade-off: A pure SPA penalizes startup and SEO with JavaScript most of the page does not need.
Decision: Astro with static output and React islands only where there is interactivity (analysis, chat): better performance and SEO without giving up React where it adds value.

5. Django + DRF as the backbone

Context: NullBreach shares its stack with TerraCore and Root: Django REST Framework + PostgreSQL.
Trade-off: Choosing a different stack per project can optimize specific cases but fragments knowledge and slows maintenance.
Decision: Same Django + DRF backbone across all projects: consistent patterns (serializers, JWT auth, pagination) that speed up building and maintaining each one.

Results

Static analysis in production that detects OWASP Top 10 vulnerabilities (SQL injection, XSS, hardcoded secrets, and insecure error handling, among others) on code snippets pasted by the user.
Security chat with persistent context and history per user: the conversation retains the thread between messages instead of starting from scratch on each query.
Protected access with JWT authentication and paginated responses, on a Django REST Framework + PostgreSQL backend decoupled from an Astro + React frontend.

Learnings

Combining deterministic static analysis with an LLM requires separating what the engine asserts with certainty from what the model suggests: presenting them as a single response erodes trust in a security product.
Decoupling the Django backend from the Astro frontend imposed an explicit API contract from the start; that boundary forced thinking about pagination, JWT authentication, and history persistence as part of the design, not as later additions.
Prompt engineering for security is not asking 'find vulnerabilities': it requires fixing the framework (OWASP Top 10), the output format (category, severity, recommendation), and the model's role, so the diagnosis is structured and comparable across analyses.

One click away

Your next idea deserves
code that can carry it.

I design and build complete products: from the backend to the interface your users love. With integrated AI and security by design.

Projects from COP 2,000,000 / USD 500 depending on scope (MVP from 3-6 weeks).

Limited availability, I respond within 24h.

Start my project See services