POCAll data is simulated. No real GitHub, npm or database calls.

This is the Achilles proof of concept

It walks through the real workflow end to end, but every external dependency is replaced by a mock served from Next.js route handlers.

  • GitHub OAuth & JWT

    The consent screen is simulated. Tokens are unsigned look-alikes in an httpOnly cookie.

  • GitHub repositories

    Repos and package.json files come from the test-packageJson-path seed set.

  • npm registry

    A frozen snapshot of ~150 packages powers the 4-level dependency crawl.

  • Advisory database

    GHSA/CVE records are a static sample. Don't use them for real security decisions.

  • MongoDB

    Reports live in server memory, per session. Restarting the server resets them.