NSO/ orchestrator
Application Security Orchestration & Correlation

Continuous security posture,
engineered for audit.

NSO ingests output from your scanner fleet (ZAP, Nuclei, Nmap, Trivy), dedupes findings into a single source of truth, maps each one to SOC 2 / GDPR / ISO 27001 controls, and produces evidence bundles your auditors will accept.

Launch console View architecture

Features

Continuous drift

TLS expiry, DNS/DMARC, dangling CNAMEs — checked hourly.

Authenticated DAST

Inject session tokens into ZAP / Nuclei to test deep app routes.

Dedup ingest

HMAC-signed webhook collapses duplicate findings into one asset.

Compliance evidence

Each finding maps to SOC 2 / GDPR controls. One-click export.

Architecture

┌─────────────────────────────────────────────────────────┐
│              NSO COMPLIANCE ENGINE (this app)           │
│  Tenant Dashboard · Triage · Audit Bundles · RLS        │
└───────────────────────────┬─────────────────────────────┘
                            │ HMAC-signed webhook
                            ▼
┌─────────────────────────────────────────────────────────┐
│           YOUR CLOUD ORCHESTRATION LAYER                │
│       BullMQ + Redis · Worker Throttling Core           │
└───────────────────────────┬─────────────────────────────┘
                            │ Elastic Docker spin-ups
                            ▼
┌─────────────────────────────────────────────────────────┐
│         DYNAMIC MULTI-VECTOR WORKER NODES               │
│   Authenticated DAST · Drift Daemons · Tenant Scopes    │
└─────────────────────────────────────────────────────────┘
Security posture

Continuously audited, currently clean

The latest full security re-scan (2026-06-25) returned zero findings across all scanners: agent security, connector security, Supabase (Lovable Cloud), and supply-chain dependency checks.

0
Agent security
0
Connector security
0
Supabase / Lovable Cloud
0
Supply chain
View full v2 re-scan report
Security guide

Handling secrets and client-side env vars

NSO runs on Lovable Cloud. Follow these rules to keep credentials safe and avoid leaking server-only values into the browser bundle.

Service role keys

The Supabase service role key bypasses RLS. Store it as a runtime secret in your project settings, never in .env or client code. If it is ever exposed, rotate it immediately.

  • Use it only inside server functions or server routes.
  • Never return it through loaders, API responses, or logs.
  • Load the admin client inside the handler, not at module scope.

Keeping env vars out of the client

Only variables prefixed with VITE_ are exposed to the browser. Everything else is server-only.

  • Client-safe: public Supabase URL, publishable key, Turnstile site key.
  • Server-only: service role key, webhook secrets, database URL.
  • Read import.meta.env.VITE_* in components and process.env.* inside server functions.

Environment variable checklist

If a variable is not prefixed with VITE_, the browser bundler will not see it. Never rename a server secret to VITE_* to expose it.

Client-safe

  • VITE_SUPABASE_URL

    Public project URL

  • VITE_SUPABASE_PUBLISHABLE_KEY

    Public anon key; RLS still applies

  • VITE_TURNSTILE_SITE_KEY

    Renders the Turnstile widget

Server-only — never client

  • SUPABASE_SERVICE_ROLE_KEY

    Bypasses RLS; the most dangerous leak

  • SUPABASE_DB_URL

    Contains the database password

  • SUPABASE_URL

    Used by server functions and routes

  • SUPABASE_PUBLISHABLE_KEY

    Server-side publishable client only

  • TURNSTILE_SECRET_KEY

    Verifies CAPTCHA tokens server-side