Spaces:

Flamki
/

redactai

Sleeping

App Files Files Community

Flamki commited on May 17

Commit

36e5fcd

verified ·

1 Parent(s): 1d69cba

Remove breach simulator product surface

Browse files

Files changed (5) hide show

__pycache__/server.cpython-310.pyc +2 -2
dashboard.html +3 -30
dashboard.js +0 -20
index.html +4 -12
server.py +0 -84

__pycache__/server.cpython-310.pyc CHANGED Viewed

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:60a16111c476fdd2fa4b44436a4e38eed423d6d9656d9823088fd54a3258f9d8
-size 141610

 version https://git-lfs.github.com/spec/v1
+oid sha256:4dfdbd3981bd3b76cbdbc25c46a5df6cf5bcb4def45fce66b992d59e2208b36c
+size 138148

dashboard.html CHANGED Viewed

@@ -12,10 +12,9 @@
 <body>
   <!-- GLOBAL APP SWITCHER -->
-  <div class="global-switcher">
-    <a href="index.html" class="active global-link"><i data-lucide="shield-check"></i> REDACT-AI</a>
-    <a href="breach.html" class="global-link"><i data-lucide="skull"></i> BREACH ME</a>
-  </div>
   <!-- SIDEBAR -->
   <aside class="sidebar" id="sidebar">
     <div class="sidebar__header">
@@ -52,9 +51,6 @@
       <button class="sidebar__link" data-page="ai-leak" id="nav-ai-leak" onclick="switchPage('ai-leak')">
         <span class="sidebar__icon"><i data-lucide="scan-search"></i></span> <span class="sidebar__link-text">AI Leak Scan</span>
       </button>
-      <button class="sidebar__link" data-page="breach-simulator" id="nav-breach-simulator" onclick="switchPage('breach-simulator')">
-        <span class="sidebar__icon"><i data-lucide="zap"></i></span> <span class="sidebar__link-text">Breach Sim</span>
-      </button>
       <button class="sidebar__link" data-page="synthetic-attack" id="nav-synthetic-attack" onclick="switchPage('synthetic-attack')">
         <span class="sidebar__icon"><i data-lucide="syringe"></i></span> <span class="sidebar__link-text">Synthetic Tests</span>
       </button>
@@ -593,29 +589,6 @@
       </div>
     </div>
-    <!-- ===== PAGE: BREACH SIMULATOR ===== -->
-    <div class="page" id="page-breach-simulator">
-      <div class="tool-hero">
-        <div>
-          <div class="flow-kicker"><i data-lucide="zap"></i> Breach Simulator</div>
-          <h2>Run safe breach drills without attacking your systems.</h2>
-          <p>Generate a tabletop attack path, expected detections, evidence checklist, and response scorecard for privacy and AI incidents.</p>
-        </div>
-      </div>
-      <div class="tool-card">
-        <div class="tool-form tool-form--three">
-          <select class="form-input" id="breach-scenario">
-            <option value="pii_exfiltration">PII exfiltration</option>
-            <option value="ai_prompt_leak">AI prompt leak</option>
-            <option value="tracker_consent_bypass">Consent bypass</option>
-          </select>
-          <input type="text" class="form-input" id="breach-asset" value="web_app" placeholder="Asset, e.g. web_app">
-          <button class="btn btn--primary" id="breach-btn"><i data-lucide="play"></i> Build Drill</button>
-        </div>
-      </div>
-      <div class="tool-output" id="breach-output"></div>
-    </div>
     <!-- ===== PAGE: SYNTHETIC ATTACK SUITE ===== -->
     <div class="page" id="page-synthetic-attack">
       <div class="tool-hero">

 <body>
   <!-- GLOBAL APP SWITCHER -->
+  <div class="global-switcher">
+    <a href="index.html" class="active global-link"><i data-lucide="shield-check"></i> REDACT-AI</a>
+  </div>
   <!-- SIDEBAR -->
   <aside class="sidebar" id="sidebar">
     <div class="sidebar__header">
       <button class="sidebar__link" data-page="ai-leak" id="nav-ai-leak" onclick="switchPage('ai-leak')">
         <span class="sidebar__icon"><i data-lucide="scan-search"></i></span> <span class="sidebar__link-text">AI Leak Scan</span>
       </button>
       <button class="sidebar__link" data-page="synthetic-attack" id="nav-synthetic-attack" onclick="switchPage('synthetic-attack')">
         <span class="sidebar__icon"><i data-lucide="syringe"></i></span> <span class="sidebar__link-text">Synthetic Tests</span>
       </button>
       </div>
     </div>
     <!-- ===== PAGE: SYNTHETIC ATTACK SUITE ===== -->
     <div class="page" id="page-synthetic-attack">
       <div class="tool-hero">

dashboard.js CHANGED Viewed

@@ -1642,26 +1642,6 @@ function initProductTools() {
     finally { btn.disabled = false; btn.innerHTML = '<i data-lucide="search-check"></i> Run Quick Check'; if (typeof lucide !== 'undefined') lucide.createIcons(); }
   });
-  document.getElementById('breach-btn')?.addEventListener('click', async () => {
-    const btn = document.getElementById('breach-btn');
-    const out = document.getElementById('breach-output');
-    btn.disabled = true; btn.innerHTML = '<i data-lucide="loader-2" class="spin"></i> Building...';
-    try {
-      const res = await fetch(API_BASE + '/breach/simulate', {
-        method: 'POST', headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ scenario: document.getElementById('breach-scenario')?.value, asset: document.getElementById('breach-asset')?.value || 'web_app' })
-      });
-      const data = await res.json();
-      if (!res.ok) throw new Error(data.detail || 'Simulation failed');
-      render(out, `
-        <div class="tool-score"><strong>${escapeFlowHtml(data.scenario)}</strong><span>${escapeFlowHtml(data.safety)}</span></div>
-        <div class="tool-timeline">${data.stages.map(s => `<div><b>${s.step}. ${escapeFlowHtml(s.phase)}</b><span>${escapeFlowHtml(s.what_happens)}</span></div>`).join('')}</div>
-        <div class="tool-grid">${data.controls_to_verify.map(c => `<div class="tool-result-item"><strong>Control</strong><span>${escapeFlowHtml(c)}</span></div>`).join('')}</div>
-      `);
-    } catch (err) { render(out, `<div class="tool-result-item"><strong>Simulation failed</strong><span>${escapeFlowHtml(err.message)}</span></div>`); }
-    finally { btn.disabled = false; btn.innerHTML = '<i data-lucide="play"></i> Build Drill'; if (typeof lucide !== 'undefined') lucide.createIcons(); }
-  });
   document.getElementById('synthetic-btn')?.addEventListener('click', async () => {
     const btn = document.getElementById('synthetic-btn');
     const out = document.getElementById('synthetic-output');

     finally { btn.disabled = false; btn.innerHTML = '<i data-lucide="search-check"></i> Run Quick Check'; if (typeof lucide !== 'undefined') lucide.createIcons(); }
   });
   document.getElementById('synthetic-btn')?.addEventListener('click', async () => {
     const btn = document.getElementById('synthetic-btn');
     const out = document.getElementById('synthetic-output');

index.html CHANGED Viewed

@@ -18,10 +18,9 @@
   <!-- NAVBAR -->
   <nav class="navbar" id="navbar">
     <!-- GLOBAL APP SWITCHER (Top Tier of Header) -->
-    <div class="global-switcher">
-      <a href="index.html" class="active global-link"><i data-lucide="shield-check"></i> REDACT-AI</a>
-      <a href="breach.html" class="global-link"><i data-lucide="skull"></i> BREACHME AI</a>
-    </div>
     <div class="container">
       <a href="#" class="navbar__logo">
         <svg class="logo-svg" viewBox="0 0 48 48" width="36" height="36" xmlns="http://www.w3.org/2000/svg" style="margin-right:8px;">
@@ -66,14 +65,7 @@
                     <span class="dropdown-desc">Discover leaked sensitive models</span>
                   </div>
                 </a>
-                <a href="dashboard.html#breach-simulator" class="dropdown-link">
-                  <div class="dropdown-icon"><i data-lucide="zap"></i></div>
-                  <div class="dropdown-text">
-                    <span class="dropdown-name">Breach Simulator</span>
-                    <span class="dropdown-desc">Simulate data breach scenarios</span>
-                  </div>
-                </a>
-                <a href="dashboard.html#prompt-scanner" class="dropdown-link">
                   <div class="dropdown-icon"><i data-lucide="terminal-square"></i></div>
                   <div class="dropdown-text">
                     <span class="dropdown-name">Prompt Risk Scanner</span>

   <!-- NAVBAR -->
   <nav class="navbar" id="navbar">
     <!-- GLOBAL APP SWITCHER (Top Tier of Header) -->
+    <div class="global-switcher">
+      <a href="index.html" class="active global-link"><i data-lucide="shield-check"></i> REDACT-AI</a>
+    </div>
     <div class="container">
       <a href="#" class="navbar__logo">
         <svg class="logo-svg" viewBox="0 0 48 48" width="36" height="36" xmlns="http://www.w3.org/2000/svg" style="margin-right:8px;">
                     <span class="dropdown-desc">Discover leaked sensitive models</span>
                   </div>
                 </a>
+                <a href="dashboard.html#prompt-scanner" class="dropdown-link">
                   <div class="dropdown-icon"><i data-lucide="terminal-square"></i></div>
                   <div class="dropdown-text">
                     <span class="dropdown-name">Prompt Risk Scanner</span>

server.py CHANGED Viewed

@@ -2642,12 +2642,6 @@ class PromptRiskScanRequest(BaseModel):
     context: str = "general"
-class BreachSimulationRequest(BaseModel):
-    scenario: str = "pii_exfiltration"
-    asset: str = "web_app"
-    maturity: str = "standard"
 class SyntheticAttackSuiteRequest(BaseModel):
     industry: str = "saas"
     volume: int = 12
@@ -3442,79 +3436,6 @@ def _prompt_risk_report(prompt: str, context: str = "general") -> dict:
     }
-def _breach_simulation(req: BreachSimulationRequest) -> dict:
-    scenario = (req.scenario or "pii_exfiltration").lower()
-    catalog = {
-        "pii_exfiltration": {
-            "name": "PII Exfiltration Tabletop",
-            "goal": "Validate whether sensitive records can leave the product without detection.",
-            "stages": [
-                ("Initial access", "Compromised support account attempts unusual export."),
-                ("Discovery", "Actor searches for customer, invoice, and document exports."),
-                ("Collection", "Actor creates high-volume report containing PII."),
-                ("Exfiltration", "Actor attempts download or webhook delivery."),
-                ("Response", "Team validates alert, containment, and customer notification path."),
-            ],
-            "mitre": ["TA0001", "TA0007", "TA0009", "TA0010"],
-        },
-        "ai_prompt_leak": {
-            "name": "AI Prompt Leakage Tabletop",
-            "goal": "Test if prompts, secrets, or customer data can be extracted from AI workflows.",
-            "stages": [
-                ("Injection", "User tries to override assistant policy."),
-                ("Tool abuse", "Prompt requests hidden tool output or customer records."),
-                ("Sensitive output", "Model attempts to echo confidential context."),
-                ("Guardrail response", "App blocks, redacts, or escalates the event."),
-            ],
-            "mitre": ["LLM01", "LLM06", "LLM07", "LLM08"],
-        },
-        "tracker_consent_bypass": {
-            "name": "Consent Bypass Drill",
-            "goal": "Check whether trackers fire before consent or after consent withdrawal.",
-            "stages": [
-                ("Fresh visit", "Open site with no prior cookies."),
-                ("Pre-consent observation", "Monitor third-party requests and cookies."),
-                ("Withdraw consent", "Reject or withdraw tracking categories."),
-                ("Regression check", "Confirm trackers stay blocked."),
-            ],
-            "mitre": ["Privacy", "Consent", "Vendor Risk"],
-        },
-    }
-    chosen = catalog.get(scenario, catalog["pii_exfiltration"])
-    detections = [
-        "High-volume export from low-privilege or new session",
-        "Sensitive field access outside normal workflow",
-        "New third-party destination or webhook",
-        "Repeated failed access to restricted records",
-        "PII appears in AI prompt, log, analytics event, or browser storage",
-    ]
-    controls = [
-        "Role-based export limits and approval for bulk downloads",
-        "PII-aware DLP on logs, prompts, webhooks, and file exports",
-        "Step-up authentication for sensitive actions",
-        "Immutable audit log with actor, purpose, record count, and destination",
-        "Incident runbook covering containment, revocation, notification, and evidence capture",
-    ]
-    return {
-        "scenario": chosen["name"],
-        "asset": req.asset,
-        "maturity": req.maturity,
-        "safety": "Tabletop and detection validation only. No destructive payloads are executed.",
-        "goal": chosen["goal"],
-        "stages": [{"step": i + 1, "phase": phase, "what_happens": detail} for i, (phase, detail) in enumerate(chosen["stages"])],
-        "expected_detections": detections,
-        "controls_to_verify": controls,
-        "evidence_to_collect": ["audit logs", "DLP alerts", "SIEM events", "access reviews", "screenshots of blocked action"],
-        "mapping": chosen["mitre"],
-        "scorecard": [
-            {"check": "Alert fired within 5 minutes", "status": "not_run"},
-            {"check": "Owner can identify impacted records", "status": "not_run"},
-            {"check": "Export can be stopped or revoked", "status": "not_run"},
-            {"check": "Customer/regulator notification path is documented", "status": "not_run"},
-        ],
-    }
 def _synthetic_attack_suite(req: SyntheticAttackSuiteRequest) -> dict:
     volume = max(3, min(int(req.volume or 12), 50))
     names = ["Aarav Mehta", "Priya Sharma", "Rahul Gupta", "Ananya Rao", "Neha Kapoor", "Vikram Singh"]
@@ -4628,11 +4549,6 @@ def prompt_risk_scan(req: PromptRiskScanRequest):
     return _prompt_risk_report(req.prompt, req.context)
-@app.post("/api/v1/breach/simulate")
-def breach_simulate(req: BreachSimulationRequest):
-    return _breach_simulation(req)
 @app.post("/api/v1/synthetic-attack-suite/generate")
 def synthetic_attack_suite(req: SyntheticAttackSuiteRequest):
     return _synthetic_attack_suite(req)

     context: str = "general"
 class SyntheticAttackSuiteRequest(BaseModel):
     industry: str = "saas"
     volume: int = 12
     }
 def _synthetic_attack_suite(req: SyntheticAttackSuiteRequest) -> dict:
     volume = max(3, min(int(req.volume or 12), 50))
     names = ["Aarav Mehta", "Priya Sharma", "Rahul Gupta", "Ananya Rao", "Neha Kapoor", "Vikram Singh"]
     return _prompt_risk_report(req.prompt, req.context)
 @app.post("/api/v1/synthetic-attack-suite/generate")
 def synthetic_attack_suite(req: SyntheticAttackSuiteRequest):
     return _synthetic_attack_suite(req)