Problem
Case study / Verified candidate / collaborative fork / release hold
ShadowOps
A collaborative security/ML fork with a verified local evaluation candidate and explicit upstream attribution.
Target user
Reviewers evaluating the attributed hackathon collaboration and its local safety workflow.
Solution
A held candidate that runs canonical fixtures through a FastAPI evaluation boundary and React console without performing external security actions.
Personal contribution
Hardened the lite runtime, fixed domain normalization, connected the frontend to local evaluation with fixture fallback, aligned benchmark evidence, added CI/tests/docs, and produced the narrated candidate walkthrough.
Architecture
Boundaries before buzzwords.
- FastAPI lite evaluation boundary over canonical fixtures
- React console with backend health, local evaluation, and deterministic fallback
- Checked-in benchmark JSON shared by tests and UI
Main workflow
State moves with a reason.
- 01
Review fork and contributor attribution
- 02
Inspect backend health and canonical benchmark evidence
- 03
Evaluate a supported synthetic security event locally
- 04
Apply a local-only override without external action
Technical decisions
The trade-offs that define the system.
- Fork and upstream ownership remain prominent
- Domain aliases normalize before evaluation and unsupported domains fail with 422
- No sole model-training or CUDA-reproduction claim
- Overrides never trigger an external security action
Difficult engineering challenge
The workflow had to become reproducible and useful without obscuring the upstream team history or implying unverified model training and operational effectiveness.
Verification
Evidence and boundaries.
Testing
- 40 backend tests
- Frontend lint and production build
- Backend and frontend CI
- 0 known frontend npm vulnerabilities
- 3:20 narrated candidate walkthrough
Security and privacy
- Evaluation and overrides remain local-only
- Model/security effectiveness and training provenance require upstream evidence
Known limitations
- Collaborative fork with unresolved ownership and licensing gates
- CUDA training and production security effectiveness were not reproduced
- Candidate PR is intentionally unmerged and unreleased
Focused future work
- Obtain contributor, ownership, license, and model-evidence approval before any merge or release
Verified demonstration
Rendered product behavior.
Loading video metadata…