Skip to main content
Projects Live

NullBreach

An authenticated application for analyzing code snippets with OWASP-aligned guidance and asking the security assistant. Questions, answers, and analyses are stored per user.

By Valentina Ramírez · Published: June 16, 2026 · Updated: September 25, 2026

View app View repo

Summary

Next.js security application with OWASP-aligned code analysis, OpenAI chat, and persistent data in Prisma Postgres. Marketing landing in Astro.

Stack
Next.jsTypeScriptNextAuthPrismaPostgreSQLOpenAI APIAstro (landing)
01

The problem

Reviewing code with OWASP criteria or resolving a specific cybersecurity question means jumping between heavy scanners, scattered documentation, and outdated forums.

Scanners with a steep curve

Semgrep or SonarQube solve a lot, but setting up and tuning the rules costs time a quick question does not justify.

Scattered answers

Guidance is spread across dense documentation and forums that age badly.

Findings without guidance

A list of patterns is not enough if it does not explain severity, impact, and remediation.

02

What I built

  1. 01

    OpenAI Responses API analyzes code snippets for OWASP-aligned vulnerabilities, severity, impact, and remediation.

  2. 02

    Next.js App Router application combining the interface, authentication, API route handlers, and OpenAI integration.

  3. 03

    OpenAI security chat; questions and answers are stored in each user's history.

  4. 04

    Prisma ORM and Prisma Postgres for users, chat history, and code analyses.

  5. 05

    NextAuth Credentials with JWT sessions in HTTP-only cookies.

  6. 06

    The NullBreach landing remains in Astro; the main application deploys as an independent Next.js project.

OWASP analysis

Submit a snippet to OpenAI for OWASP-aligned findings, impact, and remediation guidance.

Security chat history

Ask security questions and review the questions and answers saved to your account.

Remediation guidance

The analysis explains severity and impact and suggests how to fix identified risks.

Open source

The application source is open at github.com/wavival/nullbreach.

03

Architecture decisions

1. OpenAI for OWASP-aligned analysis

Context
Manual code review requires security knowledge and time to explain impact and remediation.
Trade-off
Model responses can be wrong and should not be presented as deterministic scanner results.
Decision
OpenAI Responses API receives code with OWASP-aligned analysis instructions and explains severity, impact, and remediation.

2. Per-user chat history

Context
Questions and answers need to be associated with the account that submitted them.
Trade-off
Without persistence, users would lose the record of their previous questions.
Decision
NextAuth Credentials with JWT sessions and Prisma Postgres to store users, conversations, and analyses.

3. NextAuth for per-user sessions

Context
Sessions need to associate each person's history with their account securely.
Trade-off
Sessions must protect access and keep each account's history separate.
Decision
NextAuth Credentials uses JWT sessions in HTTP-only cookies to protect access to the application.

4. Next.js for the application

Context
The application needs an authenticated interface, chat, code analysis, and API routes.
Trade-off
Separating frontend and backend adds deployments and service contracts.
Decision
Next.js App Router combines the interface, authentication, and API routes; Astro remains for the landing page.

5. Prisma Postgres for persistence

Context
Users, chats, and analyses need managed relational persistence.
Trade-off
Keeping data access separate from interface routes helps manage the data model and migrations.
Decision
Prisma ORM on Prisma Postgres models and persists users, chat history, and code analyses.
04

Results

  • OpenAI Responses API analyzes code snippets for OWASP-aligned findings, severity, impact, and remediation guidance.

  • Chat questions and answers are stored in Prisma Postgres as user-specific history.

  • NextAuth credentials authentication with JWT sessions and Prisma Postgres persistence in a single Next.js application.

05

Learnings

  • Using a language model to review code means presenting its findings as analysis assistance rather than deterministic verification.

  • Combining the interface, authentication, and API route handlers in Next.js keeps the application boundary and deployment straightforward.

  • Security analysis with a language model requires clear instructions about the OWASP framework, severity, impact, and the recommendations it should include.

One click away

Your next idea deserves
code that can carry it.

I design and build complete products: from the backend to the interface your users love. With integrated AI and security by design.

Projects from COP 2,000,000 / USD 500 depending on scope (MVP from 3-6 weeks).

Limited availability, I respond within 24h.

Start my project See services