NETGUARDIAN

Distributed domain discovery + signed findings ingest + org triage for OWASP BLT. Clients pull jobs from a shared domain queue, spider page source for new hosts, header-scan on the researcher’s machine, then HMAC-sign findings into this Worker. The Worker never fetches third-party sites itself.

GSoC 2026 work product Project README Quickstart Documentation Pilot checklist

Pipeline
Claim domain → spider links → header findings → Sign & send → triage

How access works (production / real orgs)
A site owner registers the organization with BLT / NetGuardian and receives org credentials (HMAC ingest secret, AES payload key, triage token). They issue those keys only to the security researchers they want to participate. Downloading the client alone is not enough — without org keys, signed ingest and triage will not work against a real deployment.

Owner: register org → get keys → share keys with chosen researchers
Researcher: run the client with those keys → crawl/scan (with permission) → triage

Public demo / staging may use shared org-demo keys so mentors can try the pipeline quickly. That is not how a production org should run.

CLIENT Install & run the Flutter app — distributed crawl on your machine TRIAGE Hosted queue — review findings the client sent

Before a deeper review, researchers can ask site-owner permission (Yes/No + terms). The client discovers a contact email and opens a mail draft.

Local demo:
python3 local_dev/serve.py → API + triage on http://127.0.0.1:8787 · then cd client && flutter run -d macos

Headless one-liner (needs valid org keys for the API you post to; demo keys only on staging):
curl -fsSL https://netguardian.owaspblt.org/install.sh | sh -s -- https://your-site.example