securenow.ai

Build a minimal self-hosted app-layer security monitor using Node.js (Express), Postgres, Redis, and an LLM (OpenAI or local LLM). Core features in scope: 1) lightweight SDK middleware (npm package) that captures request metadata, headers, route, session id and request body (configurable) and posts to a local ingest endpoint; 2) ingest service (Express) that validates events, rate-limits, stores traces in Postgres and large bodies in object storage (local S3); 3) detection engine with IP reputation lookups (local blocklist and external IP intel API), rule-based detectors for brute-force, credential stuffing, scraping signatures, and a scoring pipeline that emits alerts; 4) reversible blocklist management API/CLI to add/remove IPs/users and middleware enforcement that consults Redis; 5) minimal React dashboard to list alerts/traces, show trace details, and send Slack/email alerts; 6) natural-language assistant endpoint that translates user queries to database queries and calls an LLM to summarize selected traces. Out of scope: building a proprietary IPDB, training custom threat ML models, distributed multi-tenant SaaS orchestration, and fully autonomous remediation agents. Include error handling, input validation, basic unit tests for ingestion and detection logic, and docker-compose for local deployment.