Lasse Maile

Most SCA tools stop at "you depend on a package with a known CVE". VScan builds a knowledge graph of the repository — files, dependencies, functions, call edges, HTTP entry points, docs — then runs a deterministic BFS from every entry point to see which dependencies are genuinely on a call path. Findings are correlated against OSV, flagged against CISA KEV, scored with EPSS, and ranked so the reachable and actively-exploited ones come first.

Python analysis is deep (stdlib ast, cross-file call resolution, single-hop method resolution with a proven receiver). JavaScript and Go resolve calls across files, PHP within a file. Transitive dependencies are enumerated from lockfiles and tagged, so a vulnerability three levels down still gets a verdict. The only layer that touches the network is the correlator.

Verdict-style fact-checking can't keep pace with generative AI, and it trains dependence rather than skill. Vera runs a small language model entirely on the phone: nothing is uploaded, it works offline after setup, and it costs nothing to run. Briefings summarise news from sources you pick and show each outlet's ownership and political leaning. "Check what you heard" takes a typed or spoken claim, pulls a deliberately diverse set of outlets, and coaches you on weighing them. A daily prebunking game and a SIFT Socratic coach handle the training side.

Built for the UNESCO Youth Hackathon 2026 and published as open source on IzzyOnDroid.

Linear, Embedding, LayerNorm, Dropout and CausalSelfAttention are all implemented from the tensor level up, then stacked into an 8-layer, 8-head, 512-dim model with a 512-token context. Byte-pair encoding is trained from scratch rather than imported — the merge table below is the real one, learned on Shakespeare. Generation supports temperature and top-k sampling with a KV cache and a sliding context window; training runs with AdamW at 3e-4 and mixed precision, char-level and BPE variants side by side.

Drivers follow a step-by-step workflow on their phone; dispatchers and the lab watch every truck, run, sample and document update in real time over WebSockets. Positions come from the browser's Geolocation API and land on a Leaflet site map drawn over OpenStreetMap.

The engine is domain-agnostic. A fixed library of primitive step types — QR scan, form, branch, confirm, checklist, info, photo upload — is hardcoded; everything company-specific is config: the map, the branching workflow, the fields, thresholds and product types. Bulk loading is the reference deployment, shipped as one of several onboarding templates. New facilities are built in a visual editor, with no code changes and no server restarts. Storage is three-tier — global auth, a global facility registry with versioned flows, and one SQLite database per tenant — with argon2 sessions and permission-gated dashboard, lab and admin surfaces. A local Ollama model powers the in-app driver assistant, grounded in the facility's own documents.