Blue Sentinel — Deployment Architecture

Offline / Air-Gapped Deployment

// Blue Sentinel CLI or Desktop — runs entirely on local machine. No internet required.

Developer / Analyst Machine

💻

Local Workstation

Linux / Windows / macOS
Docker or native install

air-gapped compatible

📁

Source Code

Local filesystem
Git repo / zip archive

never leaves machine

🔑

License File

Offline license key
Cryptographically signed
Node-locked or seat-based

offline validation

scan --path ./src

▼

report.json / .html

▲

Blue Sentinel Engine (Local)

🛡

Blue Sentinel CLI

bluesentinel scan ...

core analysis engine

🔍

SAST Engine

Taint analysis
AST parsing
Data flow

📦

SCA Engine

Dep graph
CVE matching
Local NVD cache

🗺

Taint Tracer

Source→sink
Call graph

🎯

Remediation

Fix planning
Effort scoring

📄

Report Generator

HTML / JSON / SARIF / PDF — written to local disk

output stays local

Output

📊

HTML Report

Interactive
Offline-ready
No CDN deps

📋

SARIF Output

GitHub / IDE
integration ready

🗂

JSON Raw

Machine-readable
findings data

Zero network traffic

Offline license validation

Analysis engine components

✓ Government / Air-gapped / High-security environments

Online SaaS Platform

// Web platform — customers upload code, scan runs on your server, report delivered via browser.

Customer

🌐

Browser

Uploads code ZIP
Views report
Manages credits

💳

Stripe Checkout

Scan packs
10 / 25 / 100
scans

payment

HTTPS upload

webhook

Your Platform (VPS — 169.58.11.51)

⚙

Nginx Reverse Proxy

SSL termination · bluesentinel.leetprotect.com
Rate limiting · WAF (ModSecurity)

🔐

Clerk Auth

JWT sessions
MFA / SSO
User sync

🖥

API Server

Node.js/Express
Scan orchestrator
Credit ledger

🛡

Blue Sentinel Engine (Docker)

SAST · SCA · Taint · Remediation — runs per-scan job in isolated container

containerized

🗄

PostgreSQL

Users · credits
Scan history
Results index

🔑

License Server

sastlicense
.leetprotect.com
Key validation

Storage

☁

Object Storage

Encrypted at rest
Per-user prefix
7-day TTL

reports only

📊

HTML Report

Signed URL
24hr expiry
Interactive

🗑

Source Code

Deleted immediately
after scan completes

ephemeral

Your platform components

Third-party services (Clerk, Stripe)

Source code deleted post-scan

Persistent data stores

Cloud Marketplace — Isolated Per-Scan

// AWS Marketplace SaaS listing — every scan gets its own ephemeral environment, destroyed on completion.

Customer

🛒

AWS Marketplace

Subscribe
Billing via AWS
Meter per scan

billing

🛒

Azure Marketplace

Subscribe
Billing via Azure
SaaS offer

billing

🌐

Web UI

Upload code
Download report
via signed URL

HTTPS / code.zip

signed URL

Your Orchestrator (Your AWS Account)

⚙

Scan Orchestrator API

Validates entitlement · creates scan ID · uploads to temp S3 · triggers ECS RunTask

📦

S3 — Temp Input

scans/{scanId}/input/code.zip
AES-256 encrypted — deleted immediately after scan

ephemeral <15 min

🔒

AWS Fargate Task (per-scan)

Spun up on demand · Destroyed on completion
2 vCPU / 4GB RAM · ~$0.02 per scan

fully isolated

🛡

Blue Sentinel

Full SAST+SCA engine

🗑

Auto-wipe

All code deleted on exit

📊

S3 — Report Output

scans/{scanId}/output/
AES-256 · 7-day TTL

report only

💰

Marketplace Metering

MeterUsage API
1 unit per scan
AWS bills customer

Security Guarantees

✓

Isolation

No task shares compute, memory, or storage with any other customer scan

✓

Ephemerality

Source code deleted from S3 the moment scan output is written

✓

Encryption

S3 AES-256 at rest · TLS in transit · task IAM role scoped per scan

✓

Destruction

Fargate task terminated · /workspace wiped · container image stateless

AWS services

Azure services

Isolated Fargate task boundary

Security guarantees

✓ Enterprise / Government / Financial Services