Live monitor · synthetic feed

Trust

What this demonstration actually does with data and security — stated honestly for technical reviewers.

Portfolio demonstration — not an operational platform

Escalation Risk Lab is a research-style UI for exploring how AI-enabled systems can change crisis escalation risk. It does not connect to real threat feeds, cloud backends (e.g. Supabase), or third-party security platforms. Claims below describe what this repository actually implements.

01 · Security posture (as built)

Risk is kept low by design: a narrow feature set, no PII, and no privileged integrations. The controls below are present in this codebase — not aspirational scanner badges for services that are not wired up.

  • Synthetic data only

    All incidents, scores, and case studies are mock data in src/lib/mock-data.ts. Nothing is collected from visitors.

  • No authentication surface

    There is no login, session store, or user account system — shrinking the attack surface for this demo.

  • Client-side scoring

    Escalation math runs in the browser via a pure module (src/lib/scoring.ts). No live intel APIs or model endpoints.

  • Swappable incident feed

    DATA_MODE=mock|replay selects the corpus via getIncidentsFeed / GET /api/incidents. Replay reads a local JSON or CSV dump — not a production SIEM.

  • Server-only config pattern

    Secrets would live in *.server.ts modules so they are not bundled to the client. None are required today.

  • Supply-chain delay (Bun)

    bunfig.toml sets minimumReleaseAge = 86400 to reduce risk from brand-new dependency publishes.

  • Unit-tested scoring engine

    Core score / spillover / explanation logic is covered by Vitest (bun run test).

02 · What this demo is / is not

In scope
  • · Illustrative escalation scoring & spillover channels
  • · Synthetic cyber / geo / energy incident corpus
  • · Transparent methods & limitations pages
  • · Local theme preference in localStorage
Out of scope
  • · Live intelligence, SIEM, or threat-intel ingestion
  • · AuthN / AuthZ, multi-tenant data, or RLS policies
  • · Guaranteed vulnerability scanning or pentest certification
  • · Production decision-support or policy recommendations

If this project later adds a backend, auth, or external connectors, this page should be updated with concrete controls (CSP, dependency CI, secrets handling) rather than template scanner language.

03 · Data handling

No personal data is collected, stored, or transmitted. There is no analytics telemetry and no session tracking beyond an optional theme key (erl-theme) in localStorage. Scores are illustrative indices, not forecasts.

04 · Architecture

Built with TanStack Start (SSR shell) + React. Incidents load through getIncidentsFeed / GET /api/incidents, switched by DATA_MODE (mock or replay). Scoring stays client-side. SSR error middleware avoids leaking stack traces to end users on catastrophic failures.