What this demonstration actually does with data and security — stated honestly for technical reviewers.
Portfolio demonstration — not an operational platform
Escalation Risk Lab is a research-style UI for exploring how AI-enabled systems can change crisis escalation risk. It does not connect to real threat feeds, cloud backends (e.g. Supabase), or third-party security platforms. Claims below describe what this repository actually implements.
01 · Security posture (as built)
Risk is kept low by design: a narrow feature set, no PII, and no privileged integrations. The controls below are present in this codebase — not aspirational scanner badges for services that are not wired up.
- Synthetic data only
All incidents, scores, and case studies are mock data in src/lib/mock-data.ts. Nothing is collected from visitors.
- No authentication surface
There is no login, session store, or user account system — shrinking the attack surface for this demo.
- Client-side scoring
Escalation math runs in the browser via a pure module (src/lib/scoring.ts). No live intel APIs or model endpoints.
- Swappable incident feed
DATA_MODE=mock|replay selects the corpus via getIncidentsFeed / GET /api/incidents. Replay reads a local JSON or CSV dump — not a production SIEM.
- Server-only config pattern
Secrets would live in *.server.ts modules so they are not bundled to the client. None are required today.
- Supply-chain delay (Bun)
bunfig.toml sets minimumReleaseAge = 86400 to reduce risk from brand-new dependency publishes.
- Unit-tested scoring engine
Core score / spillover / explanation logic is covered by Vitest (bun run test).
02 · What this demo is / is not
- · Illustrative escalation scoring & spillover channels
- · Synthetic cyber / geo / energy incident corpus
- · Transparent methods & limitations pages
- · Local theme preference in localStorage
- · Live intelligence, SIEM, or threat-intel ingestion
- · AuthN / AuthZ, multi-tenant data, or RLS policies
- · Guaranteed vulnerability scanning or pentest certification
- · Production decision-support or policy recommendations
If this project later adds a backend, auth, or external connectors, this page should be updated with concrete controls (CSP, dependency CI, secrets handling) rather than template scanner language.
03 · Data handling
No personal data is collected, stored, or transmitted. There is no analytics telemetry and no session tracking beyond an optional theme key (erl-theme) in localStorage. Scores are illustrative indices, not forecasts.
04 · Architecture
Built with TanStack Start (SSR shell) + React. Incidents load through getIncidentsFeed / GET /api/incidents, switched by DATA_MODE (mock or replay). Scoring stays client-side. SSR error middleware avoids leaking stack traces to end users on catastrophic failures.