Tech stack and credits

Architecture

Three Node ≥22 processes sharing one SQLite WAL file — an Astro 7 SSR web server, a separate background worker, and a stateless code-scan sidecar. The worker is the sole writer; a busy or restarting worker never stalls the page; requests keep serving from SQLite while it recovers. The worker only resolves each artifact's URL and hands it to the scanner, which downloads, unpacks and runs the whole static pass — line-level analysis plus Semgrep taint rules — in its own container, so a heavy scan can never starve the worker's event loop. The live event stream runs over SSE via an in-memory broker backed by a SQLite outbox, so the web process never writes to the database.

• Astro 7 SSR · Node standalone
• Node worker 10 pollers · 12 jobs
• better-sqlite3 WAL · shared db
• TypeScript 6 strict · no UI framework
• SSE in-memory broker · SQLite outbox
• Docker Compose three services · /data volume