Historical baseline
A boundary case was missed.
4 / 5
EXPECTED ALERT SCENARIOS DETECTED
1
MISSED
2026-09-24T04:40:07.878200+00:00 · Historical source content; retained unchanged.
SignalBridge
SignalBridge / Evidence viewer
Security decisions.
Evidence you can trace.
SignalBridge connects application access to security investigations. Explore real tool runs, compare source events with alerts, and inspect the evidence behind a finding.
Aman Agarwal · Recorded runs in an isolated lab
Native tool runs · October 3 to October 5
Real tools, real failures, recorded results.
Each run used a real tool in an isolated lab. Figures are read from the run's receipt and checked when this page is built.
-
A real workflow through nine failure cases
9 / 9 scenarios answered as designed
- 2 review tasks created; each retry returned its original task
- Replayed, changed, wrong-app and stale requests were refused
- A lost reply was recovered by retrying
Nine synthetic scenarios in a dedicated offline VM.
-
Leaver events from another system, verified before use
38 / 38 signed tokens verified, stored once and acknowledged
- Dry run first: 32 tokens checked, nothing stored or acknowledged
- Round 2 opened 1 access-after-departure case from real lab activity
- Round 1's 3 cases came from the sender's test backdating departures
Two lab systems on one PC, with synthetic accounts.
-
Password and TOTP sign-in, attacked and walked through
28 / 28 protocol controls passed
- Covered callback replay, a missing CSRF token, cross-app writes, signing-key rotation, back-channel logout and real session expiry
- 5 / 5 real-browser controls: keyboard sign-in, cookie attributes, CSP, framing and sign-out
A real Keycloak server and browser in an isolated lab, with synthetic accounts.
-
13.5 hours of continuous reads, with planned interruptions
27,118 / 27,118 reads delivered
- 40-minute rehearsal: all 5 interruptions recovered with 0 events late or missing
- Wazuh captured the first 10.6 hours, then hit a log-folder limit, since fixed
Not a 24-hour result; the run was stopped after the Wazuh capture ended.
-
Every record archived, every alert raised once
24 / 24 records archived
- 8 / 8 expected alerts, each raised once
- 0 missing records and 0 extra copies
- Input: the October 2 access run's 23 observations and 1 forwarded detection
One forwarded SignalBridge detection; not independent Wazuh rediscovery.
-
Collector stopped mid-run, log rotated, nothing lost
24 / 24 records archived after recovery
- 13 records waited while the collector was stopped
- The source log rotated during the run
- 0 extra copies; 8 / 8 alerts
A planned stop and rotation in the lab, not an unplanned outage.
-
A finding on the faulty build, gone after the fix
1 → 0 findings before and after the fix
- Low-risk finding from ZAP rule 10021 on the faulty build
- The corrected build, scanned the same way, had none
Authenticated passive scan of the lab reference app; not a full assessment.
-
From finding to verified fix, on a restored console
23 / 23 events restored into a separate database
- Assigned, remediation task, retest imported, independent reviewer approved
- Self-review refused; a repeated retest import created no duplicate
- The Wazuh run matched 13 events to the case
Synthetic lab data; one case through the full workflow.
-
Alerts that fire on a backlog and then clear
24 / 24 monitoring controls passed
- Queue-delay and missing-worker alerts fired, then cleared after recovery
- Requests without credentials were denied by the exporter, Prometheus and Grafana
- Every dashboard query matched the database
Lab thresholds and synthetic load, not production capacity.
Latest recorded application proof · October 2
Permission removed. Private access observed. One investigation.
Follow the genuine reference-app run: 23 processed events, a detected document-access defect and verified restoration controls. The later Wazuh collection failure is retained alongside it.
Application metadata → delivery ledger → Wazuh → reviewed receipt
No production telemetry or live service connection
September integration runs
Inspect the tools. Follow the records.
These are retained outputs from real tools. Expand records and receipts to inspect what ran, what arrived, and what failed.
Separate execution / Genuine local application checks
Access checks after membership removal.
A member could read a private state and image. The lab removed their membership, reused the same session, checked access again, then restored membership and retested. The owner served as a positive control while the former member was blocked.
16 route assertions
4 setup checks
3 restoration checks
-
Before removal
The member can retrieve the known state and image.
- Member · state · HTTP 200 allowed · assertion
- Member · image · HTTP 200 allowed · assertion
-
Remove membership
An owner removes membership; the existing session is retained.
- Membership change membership_removed · setup
-
Check the same session
Authentication still succeeds. Identity alone does not grant permission.
- Retained session · HTTP 200 same_session_authenticated · assertion
-
Recheck access and owner control
The former member's state request is denied. The image is not visible; the owner can still retrieve both.
- Former member · state · HTTP 403 denied · assertion
- Former member · image · HTTP 404 not_visible · assertion
- Owner control · state · HTTP 200 allowed · assertion
- Owner control · image · HTTP 200 allowed · assertion
-
Restore membership
The lab restores membership before its final positive checks.
- Membership recovery membership_restored · restoration
-
Verify restored access
The member sees the state and the same known image again.
- Restored member · state · HTTP 200 allowed · restoration
- Restored member · image · HTTP 200 allowed · restoration
What this establishes: the tested state route denied the former member despite valid authentication, while owner access and restored-member access worked. The image returned 404 for the former member and the known content for the owner and restored member; interpret those controls together.
Historical local checks of /api/state and /api/chat-image on a copied development app with synthetic identities. Separate from the Wazuh ledger replay; these are not the same events. A 404 alone does not prove authorization denial.
Inspect the exact checks and source identity
- Historical run
-
ba5bf541-0dcc-4559-835f-6c918eb15ac0 - Finished · UTC
- 2026-09-24T18:34:01.932112+00:00
- Copied app revision
-
286c2d7461917eb1177122b67be270f963af1232· modified copied snapshot - Copied snapshot digest
-
1b53511c58642fec4d1d4351e66689662f99bc6986e5067f5f08c0990b603ad0 - Migration content
-
d101c7136840ae5e0fcfcad534b9b4d882ad7db651577a6193e89da0ffebfedd - Receipt SHA-256
-
84d9e151cd93d3039c2a1b14c57b6c983df11b9fc2ca7976272fc44419d9df7e
Open the complete authorization receipt · includes 23 route checks and separate service checks.
| Selected recorded check | Stage | Result |
|---|---|---|
member_next_exact_state_visible
|
assertion | passed |
member_next_exact_image_visible
|
assertion | passed |
route_member_removed
|
setup | passed |
removed_member_same_session_still_auth_valid
|
assertion | passed |
removed_member_same_cookie_next_state_denied
|
assertion | passed |
removed_member_same_cookie_next_image_hidden
|
assertion | passed |
owner_next_state_survives_removal
|
assertion | passed |
owner_next_image_survives_removal
|
assertion | passed |
route_membership_restored
|
restoration | passed |
restored_member_next_state_visible
|
restoration | passed |
restored_member_next_image_visible
|
restoration | passed |
Software and detection verification
Test and detection results.
These checks support the implementation behind the integrations. Inspect their execution scope and source version, including the detection capabilities that remain unmet.
Executed checks, with a defined scope
This single-file demo makes no service connections, reads no application database and contains no live customer records. Source content matched the core receipt when this page was generated. The links at the end open optional files from the repository.
Offline verification
2059
Executed Python and Node tests · zero failures or skips
Verification groups
9 / 9
Tests, framework checks, migrations, lint, formatting and publication scan
Declared detection scenarios
15 / 15
Current recorded source · synthetic in-process scenariosPredeclared challenge matrix
Challenge results, including misses.
All existing rule checks passed, but three broader capability probes did not alert. That distinction matters: correct implementation is not complete threat coverage. This challenge was written by the builder with knowledge of the rules.
16 / 16
RULE CONTRACT CHECKS MET
0 / 3
DESIRED CAPABILITY PROBES ALERTED
These are separate denominators. An unmet capability remains visible even when every existing rule behaves as specified. Event metadata alone cannot prove unauthorized access or coordinated intent.
Explore all 19 challenges, unmet needs and evidence
| Challenge and purpose | Expectation | Observed | Outcome |
|---|---|---|---|
|
C01 · Exactly five minutes
Rule contract · The 300-second boundary is inclusive. |
R1; 1 case(s) | R1; 1 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C02 · One second outside
Rule contract · Three resources span 301 seconds: no R1 window contains all three. |
No alert; 0 case(s) | No alert; 0 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C03 · Mixed failure outcomes
Rule contract · Denied and not-visible reads both contribute to R1. |
R1; 1 case(s) | R1; 1 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C04 · Simultaneous observations
Rule contract · Three distinct resources at one timestamp still qualify. |
R1; 1 case(s) | R1; 1 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C05 · Repeated delivery below threshold
Rule contract · Replaying two event identities cannot create a third resource. |
No alert; 0 case(s) | No alert; 0 case(s) 2 accepted · 2 duplicates · 2 processed |
Met |
|
C06 · Two actor boundary
Rule contract · Two reads by one actor and one by another do not meet R1. |
No alert; 0 case(s) | No alert; 0 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C07 · Episode changes
Rule contract · Changing an episode does not reset the live actor window. |
R1; 1 case(s) | R1; 1 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C08 · Managed-device context
Rule contract · Advisory replay suppression must not suppress the live baseline. |
R1; 1 case(s) | R1; 1 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C09 · Revoked read denied
Rule contract · A single denied read after removal is not allowed access (R2). |
No alert; 0 case(s) | No alert; 0 case(s) 1 accepted · 0 duplicates · 1 processed |
Met |
|
C10 · Policy regression allowed
Rule contract · An allowed read tagged policy_regression produces R2. |
R2; 1 case(s) | R2; 1 case(s) 1 accepted · 0 duplicates · 1 processed |
Met |
|
C11 · Revoked read service error
Rule contract · An error is not evidence of allowed access and must not produce R2. |
No alert; 0 case(s) | No alert; 0 case(s) 1 accepted · 0 duplicates · 1 processed |
Met |
|
C12 · Late middle event
Rule contract · After two events are processed, a late arrival fills the qualifying window. |
R1; 1 case(s) | R1; 1 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C13 · R2 replay after processing
Rule contract · An acknowledged duplicate cannot produce a second investigation. |
R2; 1 case(s) | R2; 1 case(s) 1 accepted · 1 duplicates · 1 processed |
Met |
|
C14 · Sustained activity across buckets
Rule contract · Qualifying endpoints in two UTC buckets intentionally form two cases. |
R1; 2 case(s) | R1; 2 case(s) 4 accepted · 0 duplicates · 4 processed |
Met |
|
C15 · Allowed read is not a failure
Rule contract · Two failures and a legitimate allowed read do not meet R1. |
No alert; 0 case(s) | No alert; 0 case(s) 3 accepted · 0 duplicates · 3 processed |
Met |
|
C16 · Distinct R2 events
Rule contract · Two distinct allowed-after-removal observations each retain a case. |
R2; 2 case(s) | R2; 2 case(s) 2 accepted · 0 duplicates · 2 processed |
Met |
|
P01 · Slow enumeration
Capability probe · Desired coverage: three resources over six minutes. The existing five-minute window may miss this pattern. |
Desired: at least one alert | No alert; 0 case(s) 3 accepted · 0 duplicates · 3 processed |
Unmet |
|
P02 · Distributed probing
Capability probe · Desired coverage: one read by each of three actors. The existing per-actor rule may miss coordinated activity. |
Desired: at least one alert | No alert; 0 case(s) 3 accepted · 0 duplicates · 3 processed |
Unmet |
|
P03 · Missing revocation context
Capability probe · Desired coverage: a membership-change observation followed by an allowed read labeled member. Current metadata lacks an authoritative affected-member relationship; this tests the need for richer source context, not proof of unauthorized access. |
Desired: at least one alert | No alert; 0 case(s) 2 accepted · 0 duplicates · 2 processed |
Unmet |
- Execution
- 2026-10-05T17:30:16.004585+00:00 → 2026-10-05T17:30:16.424502+00:00
- Run ID
-
8b86fb3dec004b42a35d650257aaea24 - Source content
-
74f652fd84c22a6cc29fd22b7bc37ff2791901ea3529152e3845dce6e3988f35· 690 files · matched at generation - Predeclared catalog
-
6709461d435e6dad7f89cf9e447f3629423caf9728e11118858ddcdae0cf8345 - Public receipt
-
20261005-challenge-8b86fb3dec004b42a35d650257aaea24.json - Receipt SHA-256
-
ace8a0ca3915aad934335c1b56f39d7bee616cf8ff1b30e816e46edf80107eb9
- Predeclared builder-authored cases; authors knew the rules. Not an independent blind holdout.
- Rule-contract checks and desired capability probes have separate denominators.
- A completed execution can contain contract failures and unsupported capabilities.
- Synthetic source labels are fixture metadata; no real access or attacker activity was observed.
- Membership changes lack an authoritative affected-member relationship in this event contract.
- In-process SQLite with accidental network/process guards; not production capacity or an OS sandbox.
Inspect the executed checks and source identity
Core verification
Passed · source matched at generation9 fixed offline check groups cover the workbench implementation. Node suites test courier and HTTP-harness behavior using mocks; their counts do not represent requests to real Supabase services.
| Executed check | Result | Tests | Seconds |
|---|---|---|---|
| django-tests | Passed | 1997 | 95.313 |
| django-check | Passed | — | 1.392 |
| migration-drift | Passed | — | 1.419 |
| ruff-check | Passed | — | 0.042 |
| ruff-format | Passed | — | 0.041 |
| publication-scan | Passed | — | 17.29 |
| node-courier-tests | Passed | 22 | 0.253 |
| node-http-harness-mock-tests | Passed | 17 | 0.125 |
| node-bettail-route-mock-tests | Passed | 23 | 0.136 |
Inspect core provenance and coverage limits
- Execution started
- 2026-10-05T17:28:04.562929+00:00
- Execution finished
- 2026-10-05T17:30:02.792896+00:00
- Run ID
-
20261005T172804562269Z-73bbd2b8 - Git revision
-
e404062a53fb04a0010ed49029c2d21998277c00· working tree had changes - Source content
-
74f652fd84c22a6cc29fd22b7bc37ff2791901ea3529152e3845dce6e3988f35· 690 files - Public receipt
-
20261005T172804562269Z-73bbd2b8.json - Receipt SHA-256
-
af918701901708e1f38002c2396609436d4045f88d2f7098aeb15f0b0d1ffb04
- Builder-operated local core verification; not an independent audit.
- Node courier, HTTP-harness and BetTail route suites use mocks; they do not contact real services.
- No real Supabase auth, source-app HTTP/storage, PostgreSQL concurrency or container tests.
- No dependency advisory lookup, remote CI, deployment or production validation.
- Hashes identify content; a filesystem administrator can replace logs and receipts.
- Documentation and generated evidence are excluded from the source digest.
Explore the detection gap, correction and regression results
Fixing a missed scenario
Builder-authored synthetic labThe original simulation exposed a time-window boundary gap. Compare recorded outcomes on the same declared scenarios, and inspect the individual results below.
Current recorded implementation
Rechecked against the same 15 scenarios.
5 / 5
EXPECTED ALERT SCENARIOS DETECTED
0
MISSED
2026-10-05T17:30:10.126627+00:00 · Source matched at page generation.
The comparison uses five expected-alert and ten expected-no-alert scenarios. These development cases are not an independent holdout or a measurement of production detection accuracy. A code change and its retest are separate recorded executions.
Current simulation · 15 / 15 scenarios met
passedExecuted 2026-10-05T17:30:06.420945+00:00 → 2026-10-05T17:30:10.126627+00:00 · disposable in-memory SQLite · Django in-process test client
| True positive | False negative | False positive | True negative | Accepted / processed |
|---|---|---|---|---|
| 5 | 0 | 0 | 10 | 600 / 600 |
Single-process SQLite harness timing includes test-client overhead; not network or production capacity. The bounded benign load generated 0 alerts. Timings are retained in metrics.json; they are not a capacity promise.
Expand all scenarios and execution identity
| Scenario | Expected rule | Observed rule | Coverage |
|---|---|---|---|
| authorized_read | None | None | Met |
| distinct_private_failures | R1 | R1 | Met |
| same_resource_retries | None | None | Met |
| below_threshold | None | None | Met |
| bucket_boundary_gap | R1 | R1 | Met |
| revoked_read_allowed | R2 | R2 | Met |
| controlled_policy_fault | R2 | R2 | Met |
| successful_membership_change | None | None | Met |
| session_errors_not_private_reads | None | None | Met |
| dependency_errors | None | None | Met |
| mixed_sources | None | None | Met |
| cross_application | None | None | Met |
| mixed_environments | None | None | Met |
| out_of_order | R1 | R1 | Met |
| duplicate_delivery | None | None | Met |
- Run ID
-
e69afefc6019460cbbbac918f04f637d - Git revision
-
e404062a53fb04a0010ed49029c2d21998277c00· working tree had changes - Source content
-
74f652fd84c22a6cc29fd22b7bc37ff2791901ea3529152e3845dce6e3988f35· 690 files - Public receipt
-
20261005-simulation-e69afefc6019460cbbbac918f04f637d.json - Receipt SHA-256
-
5724ccf83f6c21b3d02bd60111aadd4c4f5fd06677e444f766930fb1651321de - Recorded result hash
-
084157f3a123e80e8d26d0e6531931e7be9157e62e122d2953c07c8c1b975026· private original bytes not reread by this page builder
Not tested in this simulation:
- Endpoint or cloud inventory
- Live adversary exploitation
- Production traffic
- Multi-node availability
- PostgreSQL concurrency or crash durability
- Network HTTP latency
- Competitor products
- Independent blind holdout
- Automated external response
Historical baseline · 14 / 15 scenarios met
partialExecuted 2026-09-24T04:40:05.353490+00:00 → 2026-09-24T04:40:07.878200+00:00 · disposable in-memory SQLite · Django in-process test client
| True positive | False negative | False positive | True negative | Accepted / processed |
|---|---|---|---|---|
| 4 | 1 | 0 | 10 | 600 / 600 |
Single-process SQLite harness timing includes test-client overhead; not network or production capacity. The bounded benign load generated 0 alerts. Timings are retained in metrics.json; they are not a capacity promise.
Expand all scenarios and execution identity
| Scenario | Expected rule | Observed rule | Coverage |
|---|---|---|---|
| authorized_read | None | None | Met |
| distinct_private_failures | R1 | R1 | Met |
| same_resource_retries | None | None | Met |
| below_threshold | None | None | Met |
| bucket_boundary_gap | R1 | None | Missed |
| revoked_read_allowed | R2 | R2 | Met |
| controlled_policy_fault | R2 | R2 | Met |
| successful_membership_change | None | None | Met |
| session_errors_not_private_reads | None | None | Met |
| dependency_errors | None | None | Met |
| mixed_sources | None | None | Met |
| cross_application | None | None | Met |
| mixed_environments | None | None | Met |
| out_of_order | R1 | R1 | Met |
| duplicate_delivery | None | None | Met |
- Run ID
-
a69f778bb91d433691bc1c1e70b5f260 - Git revision
-
a6398ec42994e26deabe646d980c86c29f326a9c· working tree had changes - Source content
-
adae7bc5ca52c84f87da77ef04a4fc9faef9a4671675bfa0d054a3af624158fd· 126 files - Public receipt
-
20260924-offline-simulation.json - Receipt SHA-256
-
fd42303052d1b63b6866f5f69ce1a39390b37df838cfe3cb9ce0f11019c1e7d6 - Recorded result hash
-
5ee88efc509d50f5e393cbc3e0b0b7680f99bdb9689f3e33c0e0b27cf14ea673· private original bytes not reread by this page builder
Not tested in this simulation:
- Endpoint or cloud inventory
- Live adversary exploitation
- Production traffic
- Multi-node availability
- PostgreSQL concurrency or crash durability
- Network HTTP latency
- Competitor products
- Independent blind holdout
- Automated external response
Technical work represented
What was built.
Python and Django authorization, signed ingestion, durable queue processing, scope-aware detections, scanner-report normalization, provenance-aware review and adverse testing.
Separate receipts record genuine local Supabase Auth/REST/Storage checks, two copied BetTail application routes, and bounded synthetic Wazuh and ZAP pilots. Those executions are separate from the offline counts above. They do not establish continuous monitoring, complete application coverage or production readiness.
Interpretation
What these results show.
- Self-run evidence, not an outside audit or an enterprise benchmark.
- Core verification and synthetic simulation are different executions with separate dates.
- The current source is compared with the core and current simulation receipts at generation only.
- Public receipts are reviewed summaries, not signatures or independently attested executions.
- Receipt bytes are hashed here; original private logs, raw results and provenance are not reread.
- A matching source digest does not verify runtime configuration, dependencies or deployment.
- No runtime AI, live attacker exercise, production capacity or competitor superiority is measured.