02 / ENGINEERING CASE STUDY
DepHawk
An event-driven vulnerability scanner for GitHub repositories managed entirely from a native Discord app. It inspects dependency manifests via the GitHub API, checks OSV and EPSS for exploit risks, tracks semantic version drift, and pushes alerts directly to Discord channels.
Discord app
An interactive security app inside a Discord server, with buttons, menus, alerts, and a dedicated #dephawk channel. Built to run on the AWS Free Tier.External REST APIs
The GitHub Git Trees API fetches and maps dependency manifests on every push, storing the results in DynamoDB. Google OSV checks for vulnerabilities, deps.dev tracks version drift, and FIRST.org EPSS scores exploit probability.How scans start
GitHub push webhooks, manual Discord button clicks, and an EventBridge cron all trigger the same pipeline. Each drops a message into SQS, which fans out to the Scanner Worker Lambdas to run the scan.How it ships safely
GitHub Actions runs four parallel jobs on every push: Ruff for code quality, Pytest for unit and E2E tests, and a triple-layer Snyk scan covering SCA, SAST, and IaC. Deployed via a single CDK script.SRE & Observability
AWS Lambda Powertools enforces structured JSON logging and distributed tracing across the pipeline. This provides instant CloudWatch visibility into SQS fan-outs, webhook latencies, and API failures without manual log digging.PRODUCT, IN PLAIN ENGLISH
DepHawk is a security scanner that lives natively inside your team's Discord server, powered by an event-driven AWS serverless backend. A scan can be triggered by a GitHub push, clicking a button in Discord, or an automated EventBridge schedule. Instead of doing a heavy git clone, it uses the GitHub REST API to instantly locate and fetch your package files. It then queries Google OSV for vulnerabilities, deps.dev to check how out-of-date packages are, and FIRST.org EPSS to see how likely an exploit actually is. The result is a clean Discord alert, with massive JSON reports securely offloaded to temporary S3 URLs.
REQUEST / EVENT LIFECYCLE
TECHNICAL ARCHITECTURE
How it is built.
The serverless backend uses a distributed 3-Lambda pipeline to decouple fast webhook acknowledgment from slow API scans. The Gateway Lambda handles synchronous ingress from GitHub or Discord webhooks, responding instantly to prevent timeouts. The Orchestrator Lambda dynamically fetches the latest code manifests and fans out the packages into an SQS queue. Scanner Workers then pull from SQS to query the external APIs, routing any failed scans to a Dead Letter Queue. SQS acts as the distributed backbone that physically separates these tiers. Additionally, an EventBridge cron can independently drop messages directly into SQS to trigger automated sweeps even when no one pushes code.
FULL STACK / CLOUD / DEVOPS
The stack, organized
by responsibility.
Discord Interactive UI
Instead of a static chat bot, it uses Discord's Interactive API to render a clickable control center. OAuth onboarding automatically creates the #dephawk channel and sets up the dashboard.
REST API Integrations
This is not a static tool. On every git push or EventBridge tick, it uses the GitHub Git Trees REST API to dynamically fetch the latest dependency manifests without slow git clones. It maps the dependencies and uses HTTP/2 multiplexing (via `httpx`) to concurrently blast queries to Google OSV for vulnerabilities, deps.dev for version drift, and FIRST.org EPSS for exploit probabilities - drastically reducing Lambda execution time by preventing TCP connection exhaustion. Finally, it maps the aggregated results into DynamoDB.
FastAPI Webhook Gateway
The entry point is a FastAPI app running on AWS Lambda. It uses Pydantic to validate incoming data and PyNaCl to cryptographically verify Discord's ED25519 signatures, ensuring every request is authentic.
Bypassing Database Limits
DynamoDB has a strict 400 KB size limit, which isn't enough for large vulnerability reports. To fix this, DepHawk splits the data: it saves a tiny "health summary" for instant UI loading, and heavily compresses the full detailed report into a second record.
Handling Large File Downloads
Discord restricts messages to 2,000 characters and button links to short URLs. To deliver massive JSON audit reports, DepHawk saves them to Amazon S3. But because secure S3 "presigned" URLs are extremely long, they break Discord's buttons. To fix this, the Discord download button points to a short API Gateway link. When clicked, API Gateway instantly generates a secure, 2-hour temporary S3 link and redirects the user's browser to it. This keeps the Discord UI clean while keeping the files completely secure.
Zero-Latency Observability
It uses AWS Lambda Powertools and the CloudWatch Embedded Metric Format (EMF). This asynchronously publishes custom metrics (like scan failures) directly to standard output, powering CloudWatch alarms without adding any network delay to the scanner.
Infrastructure & GitOps Workflow
The entire architecture is defined in AWS CDK for a single-command deployment to the AWS Free Tier. AWS CDK automatically packages the Python Lambdas as lightweight `.zip` assets (rather than heavy ECR containers) for lightning-fast deployments. Before deploying, the GitHub Actions GitOps pipeline executes strict checks for Code Quality, Unit Tests, E2E Testing, and a triple-layer Snyk security scan.
ENGINEERING DECISIONS
Why these choices matter.
DepHawk turns a regular Discord channel into a full security dashboard using native embeds, buttons, and select menus. Developers don't have to switch tabs or remember another password just to check if their code is vulnerable. To keep the channel clean, the app uses a "floating" UI: when a new scan finishes, it deletes the old dashboard and posts a fresh one at the bottom of the chat, triggering a notification so the team always sees the latest status.