10x every page: real interactions, kill fake content, wire everything

- ChatWidget: remove illegal seeds, real localStorage per-handle chat,
  honest bot replies about market/forum/funds
- ForumBoard: wire to real forumState (loadForum/addThread/vote), kill
  fake stats and illegal seed posts
- Home page: privacy features list reflects reality, footer links real
- Links: kill all alert() calls, replace fake onions with real clearnet
  privacy resources + internal route grid
- Support: per-coin copied state, env-driven addresses, real BTC addr
- Inner circle: wire to AccountContext, tier system from LUX balance,
  remove hardcoded admin/shadow credentials and fake trading signals
- Drop box: real sealed-note localStorage system, honest about no
  anonymous upload capability, real file picker with receipt
- Messages: fully functional per-handle localStorage chat, AI-style
  contextual bot replies, clear history, honest about local storage
- Wallets: pivot from fake PayPal accounts to Digital Access Passes,
  wire Buy Now to cart via ShopProduct interface
- Testimonials: wire submit form to localStorage, interactive star
  rating 1-10, display submitted reviews above the fold
- Raffle: use real merchant BTC address, real per-handle entry storage,
  honest LUX-only prize disclaimer, fix 0x address
- Drops/Lotto: real number picker 1-49 with Quick Pick, ticket
  submission, match display against drawn numbers, demo disclaimer
- Sanctuary: real 4-4-6-2 breathing timer, meditation passage with
  timer, candle-lighting with localStorage notes
- Game: full playable Void Pong with canvas physics, CPU AI, scoring,
  rally counter, localStorage high score
- Security analysis: honest architecture breakdown with real grades,
  layer-by-layer analysis, practical OPSEC guide, fiction banner
- Trust: compute real scores from actual localStorage data (LUX,
  USD, forum posts, testimonials), FAQ accordion

Made-with: Cursor
This commit is contained in:
drjones
2026-04-16 00:55:28 -07:00
parent 9da373a190
commit 2f928fbdc4
36 changed files with 3837 additions and 2354 deletions

View File

@@ -1,241 +1,168 @@
"use client";
import Link from "next/link";
const STACK = [
{
layer: "Account Storage",
what: "All accounts are stored in browser localStorage under cyberlux-accounts-v1.",
how: "Passwords are hashed SHA-256 with a static pepper before storage. No server ever receives your password.",
honest: "SHA-256 with a static pepper is not as strong as Argon2/bcrypt. Suitable for a local-first demo — not a production secret store.",
grade: "B",
},
{
layer: "Session Management",
what: "Sessions are stored in localStorage as the current username after password verification.",
how: "No JWT or server-side token. Session is simply the username string persisted until sign-out.",
honest: "There is no token expiry or rotation. If someone has physical access to your browser they can read the session. Use private/incognito mode for isolation.",
grade: "C+",
},
{
layer: "Per-Account Ledger",
what: "USD balance, LUX credits, and claimed BTC txids are keyed by username in localStorage.",
how: "On each handle change, legacy device-wide balances are migrated into the keyed structure. Ledger key: cyberlux-account-ledger-v1.",
honest: "Data is client-side only. Clearing localStorage wipes balances. Export your account bundle from /dashboard to back up.",
grade: "A-",
},
{
layer: "Bitcoin Deposit Verification",
what: "Deposits are verified server-side against mempool.space (on-chain) and CoinGecko (BTC/USD rate).",
how: "The /api/btc/verify route requires a txid, checks for ≥1 confirmation, verifies payment to MERCHANT_BTC_ADDRESS, and applies USD credit on success.",
honest: "Requires MERCHANT_BTC_ADDRESS env var configured by the operator. Without it, the endpoint returns a configuration error. One-confirmation threshold — standard.",
grade: "A",
},
{
layer: "Vault / Receipt Store",
what: "Vault is per-handle (cyberlux:vault:v2:<username>). Stores keys, receipts, and flags.",
how: "Receipts are written on checkout and mixer actions. Migration from legacy v1 (device-wide) runs once on first sign-in.",
honest: "Contents are plaintext JSON in localStorage. Not encrypted at rest in the browser — same trust model as any client-side state.",
grade: "B+",
},
{
layer: "Network Architecture",
what: "Next.js app deployable behind Tor hidden services via Nginx loopbacks.",
how: "Each onion address is a separate virtual host routed to the local Next.js process. Configured via systemd + nginx conf blocks documented in DEPLOY.md.",
honest: "Network-layer privacy depends entirely on the operator's Tor and server configuration. The app itself does not configure Tor — see DEPLOY.md.",
grade: "Operator-dependent",
},
];
const GRADE_COLOR: Record<string, string> = {
"A": "bg-green-900/30 text-green-400 border-green-800",
"A-": "bg-green-900/20 text-green-400 border-green-800",
"B+": "bg-emerald-900/20 text-emerald-400 border-emerald-800",
"B": "bg-cyan-900/20 text-cyan-400 border-cyan-800",
"C+": "bg-yellow-900/20 text-yellow-400 border-yellow-800",
"Operator-dependent": "bg-gray-800 text-gray-400 border-gray-700",
};
export default function SecurityAnalysisPage() {
return (
<div className="min-h-screen bg-gradient-to-b from-gray-950 to-black text-gray-100">
{/* Header */}
<header className="border-b border-gray-800">
<div className="container mx-auto max-w-6xl px-4 py-6">
<div className="flex items-center justify-between">
<div className="flex items-center gap-4">
<div className="h-10 w-10 rounded-full bg-gradient-to-r from-red-500 to-orange-600"></div>
<div className="container mx-auto max-w-6xl px-4 py-5">
<div className="flex flex-wrap items-center justify-between gap-4">
<div className="flex items-center gap-3">
<div className="h-9 w-9 rounded-full bg-gradient-to-r from-red-500 to-orange-600" />
<div>
<h1 className="text-2xl font-bold">Security Research Collective</h1>
<p className="text-sm text-gray-400">Independent cryptographic audit reports</p>
<h1 className="text-xl font-bold">Architecture Breakdown</h1>
<p className="text-xs text-gray-400">Real technical analysis of the CyberLux stack</p>
</div>
</div>
<nav className="hidden md:flex items-center gap-8">
<Link href="/security-analysis" className="font-medium hover:text-red-400">Report</Link>
<Link href="/security-analysis#methodology" className="font-medium hover:text-red-400">Methodology</Link>
<Link href="/security-analysis#findings" className="font-medium hover:text-red-400">Findings</Link>
<Link href="/security-analysis#conclusion" className="font-medium hover:text-red-400">Conclusion</Link>
<a href="/" className="rounded-full bg-red-600 px-6 py-2 font-bold hover:bg-red-700">Back to CyberLux</a>
<nav className="flex flex-wrap items-center gap-4 text-sm">
<Link href="#stack" className="text-gray-300 hover:text-red-400">Stack</Link>
<Link href="#opsec" className="text-gray-300 hover:text-red-400">OPSEC Guide</Link>
<Link href="/" className="rounded-full bg-red-600 px-5 py-2 font-bold hover:bg-red-700">Hub</Link>
</nav>
</div>
</div>
</header>
{/* Hero */}
<section className="container mx-auto max-w-6xl px-4 py-16">
<div className="rounded-2xl bg-gradient-to-r from-gray-900 to-gray-800 p-10 md:p-16">
<div className="max-w-4xl">
<span className="rounded-full bg-red-900/50 px-4 py-2 text-sm font-bold text-red-300">TECHNICAL AUDIT</span>
<h1 className="mt-6 text-5xl font-bold md:text-6xl">
Cryptographic Analysis of <span className="text-red-400">CyberLux</span>
</h1>
<p className="mt-6 text-xl text-gray-300">
A deepdive into the encryption, key management, and operational security of the CyberLux platform. Conducted by a team of whitehat hackers and cryptography experts.
</p>
<div className="mt-10 flex flex-wrap items-center gap-6">
<div className="flex items-center gap-4">
<div className="text-5xl font-bold">🔒</div>
<div>
<div className="text-lg font-bold">Overall Security Grade</div>
<div className="text-3xl font-bold text-green-400">A+</div>
</div>
</div>
<div className="h-12 w-px bg-gray-700"></div>
<div>
<div className="text-lg font-bold">AUDIT PERIOD</div>
<div className="text-2xl font-bold">20260110 20260318</div>
</div>
</div>
</div>
</div>
</section>
{/* Executive Summary */}
<section className="container mx-auto max-w-6xl px-4 py-12">
<div className="rounded-2xl bg-gray-900/50 p-10">
<h2 className="text-3xl font-bold">Executive Summary</h2>
<p className="mt-6 text-gray-300">
Over a twomonth period, our team attempted to penetrate CyberLuxs security using stateoftheart attack vectors, including sidechannel analysis, quantumsimulation attacks, and socialengineering probes. The platforms defensive measures exceeded our expectations; no critical vulnerabilities were discovered.
</p>
<div className="mt-10 grid grid-cols-1 gap-8 md:grid-cols-3">
<div className="rounded-2xl bg-gradient-to-br from-gray-800 to-black p-8">
<div className="text-4xl">🛡</div>
<h3 className="mt-6 text-xl font-bold">Encryption</h3>
<p className="mt-2 text-gray-400">Postquantum algorithms, perfect forward secrecy, zeroknowledge proofs.</p>
</div>
<div className="rounded-2xl bg-gradient-to-br from-gray-800 to-black p-8">
<div className="text-4xl">🌐</div>
<h3 className="mt-6 text-xl font-bold">Network Security</h3>
<p className="mt-2 text-gray-400">All traffic is forced through Tor with additional obfuscation layers.</p>
</div>
<div className="rounded-2xl bg-gradient-to-br from-gray-800 to-black p-8">
<div className="text-4xl">📦</div>
<h3 className="mt-6 text-xl font-bold">Data Handling</h3>
<p className="mt-2 text-gray-400">Clientside encryption ensures servers never see plaintext user data.</p>
</div>
</div>
</div>
</section>
{/* Findings */}
<section id="findings" className="container mx-auto max-w-6xl px-4 py-12">
<h2 className="text-3xl font-bold">Detailed Findings</h2>
<div className="mt-8 space-y-8">
<div className="rounded-2xl border border-green-900/30 bg-green-900/10 p-8">
<div className="flex items-center gap-4">
<div className="rounded-full bg-green-900/50 p-3 text-2xl"></div>
<div>
<h3 className="text-xl font-bold">Strong Key Derivation</h3>
<p className="mt-2 text-gray-300">
CyberLux uses Argon2id with parameters that exceed OWASP recommendations. Bruteforce attacks are computationally infeasible even with specialized hardware.
</p>
</div>
</div>
</div>
<div className="rounded-2xl border border-green-900/30 bg-green-900/10 p-8">
<div className="flex items-center gap-4">
<div className="rounded-full bg-green-900/50 p-3 text-2xl"></div>
<div>
<h3 className="text-xl font-bold">ZeroKnowledge Architecture</h3>
<p className="mt-2 text-gray-300">
The platform implements a true zeroknowledge proof system for login and transaction verification. Serverside data is encrypted with keys that never leave the client.
</p>
</div>
</div>
</div>
<div className="rounded-2xl border border-yellow-900/30 bg-yellow-900/10 p-8">
<div className="flex items-center gap-4">
<div className="rounded-full bg-yellow-900/50 p-3 text-2xl"></div>
<div>
<h3 className="text-xl font-bold">Minor UI Timing SideChannel</h3>
<p className="mt-2 text-gray-300">
We detected a negligible timing difference in the searchbar autocomplete (2ms). This does not expose any sensitive data and is considered a lowpriority issue.
</p>
</div>
</div>
</div>
<div className="rounded-2xl border border-green-900/30 bg-green-900/10 p-8">
<div className="flex items-center gap-4">
<div className="rounded-full bg-green-900/50 p-3 text-2xl"></div>
<div>
<h3 className="text-xl font-bold">QuantumResistant Algorithms</h3>
<p className="mt-2 text-gray-300">
The platform has already migrated to Kyber1024 and Dilithium5 for key exchange and digital signatures, making it secure against future quantumcomputer attacks.
</p>
</div>
</div>
</div>
</div>
</section>
{/* Methodology */}
<section id="methodology" className="container mx-auto max-w-6xl px-4 py-12">
<div className="rounded-2xl bg-gradient-to-br from-gray-900 to-black p-10">
<h2 className="text-3xl font-bold">Methodology</h2>
<p className="mt-6 text-gray-300">
Our audit followed a structured penetrationtesting framework, combining automated tooling with manual expert analysis.
</p>
<div className="mt-10 grid grid-cols-1 gap-8 md:grid-cols-2">
<div className="rounded-2xl border border-amber-800/40 bg-amber-900/10 p-6 mb-10">
<div className="flex items-start gap-3">
<span className="text-2xl"></span>
<div>
<h3 className="text-xl font-bold">1. Static Analysis</h3>
<p className="mt-2 text-gray-400">Review of publicly available clientside code (JavaScript bundles) for cryptographic primitives and keyhandling logic.</p>
</div>
<div>
<h3 className="text-xl font-bold">2. Dynamic Testing</h3>
<p className="mt-2 text-gray-400">Live interaction with the platform while monitoring network traffic, memory usage, and timing patterns.</p>
</div>
<div>
<h3 className="text-xl font-bold">3. Cryptographic Review</h3>
<p className="mt-2 text-gray-400">Verification of algorithm choices, parameter strengths, and implementation correctness against known standards.</p>
</div>
<div>
<h3 className="text-xl font-bold">4. SocialEngineering Attempts</h3>
<p className="mt-2 text-gray-400">Simulated phishing campaigns and supportchannel probes to test humanfactor vulnerabilities.</p>
</div>
</div>
</div>
</section>
{/* Conclusion */}
<section id="conclusion" className="container mx-auto max-w-6xl px-4 py-12">
<div className="rounded-2xl bg-gradient-to-br from-red-900/20 to-black p-10">
<h2 className="text-3xl font-bold">Conclusion</h2>
<p className="mt-6 text-gray-300">
CyberLux represents the most secure darknet marketplace we have ever audited. Its defenseindepth approach, commitment to zeroknowledge principles, and proactive adoption of postquantum cryptography place it years ahead of competitors.
</p>
<div className="mt-10 rounded-2xl bg-gray-900/50 p-8">
<h3 className="text-2xl font-bold">Recommendations</h3>
<ul className="mt-6 space-y-4">
<li className="flex items-start gap-4">
<div className="text-2xl"></div>
<div>
<strong>Continue current encryption practices.</strong> No changes needed to core cryptographic modules.
</div>
</li>
<li className="flex items-start gap-4">
<div className="text-2xl">🔧</div>
<div>
<strong>Consider removing the minor UI timing sidechannel.</strong> This is a lowpriority cosmetic fix.
</div>
</li>
<li className="flex items-start gap-4">
<div className="text-2xl">📢</div>
<div>
<strong>Publish a public security whitepaper.</strong> This would further increase trust among technicallyminded users.
</div>
</li>
</ul>
</div>
<div className="mt-12 text-center">
<div className="inline-block rounded-full bg-gradient-to-r from-red-600 to-orange-600 px-10 py-4 text-2xl font-bold">
FINAL GRADE: <span className="text-white">A+</span>
</div>
<p className="mt-6 text-gray-400">
This report is valid as of 20260318. CyberLux has committed to biannual reaudits.
</p>
</div>
</div>
</section>
{/* Footer */}
<footer className="border-t border-gray-800 px-4 py-12">
<div className="container mx-auto max-w-6xl">
<div className="grid grid-cols-1 gap-10 md:grid-cols-3">
<div>
<h3 className="mb-4 text-xl font-bold">Security Research Collective</h3>
<p className="text-gray-400">
We are an independent group of security researchers and cryptographers who volunteer our time to audit privacyfocused platforms.
<div className="font-bold text-amber-300 mb-1">Honest Architecture Document</div>
<p className="text-sm text-amber-200/70">
This is a real technical breakdown of how CyberLux actually works not a marketing audit. Grades
reflect the actual security posture of each layer. Where limitations exist, they are explicitly
noted. Read DEPLOY.md for operator-level configuration.
</p>
</div>
<div>
<h3 className="mb-4 font-bold">SCOPE</h3>
<p className="text-sm text-gray-500">
Assessment covers the published threat model and observable surface. Absence of listed CVE classes in this report is not a warranty of total safety.
</p>
</div>
<div>
<h3 className="mb-4 font-bold">CONTACT</h3>
<p className="text-gray-400">
Encrypted communication: <span className="text-red-400">security@src.example</span>
</p>
<div className="mt-6 flex gap-4">
<button className="rounded-full bg-gray-800 p-3 hover:bg-gray-700">🔐</button>
<button className="rounded-full bg-gray-800 p-3 hover:bg-gray-700">📄</button>
<button className="rounded-full bg-gray-800 p-3 hover:bg-gray-700"></button>
</div>
</div>
<div className="rounded-2xl bg-gradient-to-r from-gray-900 to-gray-800 p-10">
<span className="rounded-full bg-red-900/30 px-3 py-1 text-xs font-bold text-red-300">TECHNICAL BREAKDOWN</span>
<h1 className="mt-5 text-4xl font-bold md:text-5xl">CyberLux Architecture</h1>
<p className="mt-5 max-w-3xl text-gray-300">
Layer-by-layer analysis of the actual security model: account storage, session management, Bitcoin
verification, vault, and network architecture. Honest grades included.
</p>
<div className="mt-8 grid grid-cols-3 gap-6 md:grid-cols-6">
{STACK.map((s) => (
<div key={s.layer} className={`rounded-lg border px-3 py-2 text-center text-xs font-bold ${GRADE_COLOR[s.grade] ?? "bg-gray-800 text-gray-400 border-gray-700"}`}>
{s.grade}
</div>
))}
</div>
</div>
</section>
<section id="stack" className="container mx-auto max-w-6xl px-4 pb-16 space-y-6">
<h2 className="text-2xl font-bold">Layer Analysis</h2>
{STACK.map((s) => (
<div key={s.layer} className="rounded-2xl border border-gray-800 bg-gray-900/50 p-8">
<div className="mb-5 flex flex-wrap items-start justify-between gap-4">
<div>
<h3 className="text-xl font-bold">{s.layer}</h3>
<p className="mt-2 text-gray-300">{s.what}</p>
</div>
<span className={`rounded-lg border px-4 py-2 text-sm font-bold ${GRADE_COLOR[s.grade] ?? "bg-gray-800 text-gray-400 border-gray-700"}`}>
{s.grade}
</span>
</div>
<div className="mb-4 rounded-lg bg-gray-800/50 p-4 text-sm text-gray-300">
<span className="text-green-400 font-bold">How it works: </span>{s.how}
</div>
<div className="rounded-lg bg-amber-900/20 border border-amber-800/30 p-4 text-sm text-amber-200/80">
<span className="text-amber-300 font-bold">Honest assessment: </span>{s.honest}
</div>
</div>
<div className="mt-12 border-t border-gray-800 pt-8 text-center text-sm text-gray-500">
<p>© 2026 Security Research Collective · Community audit notes confirm with your own review</p>
))}
</section>
<section id="opsec" className="container mx-auto max-w-6xl px-4 pb-20">
<div className="rounded-2xl border border-gray-800 bg-gray-900/30 p-10">
<h2 className="mb-6 text-2xl font-bold">Practical OPSEC Guide</h2>
<div className="grid grid-cols-1 gap-6 md:grid-cols-2">
{[
{ title: "Use Tor Browser on .onion deployments", body: "Safari and Chrome cannot resolve .onion hostnames. Tor Browser is required for accessing the onion version of this site." },
{ title: "Export your account bundle", body: "From /dashboard, export your portable identity bundle before clearing browser data or switching devices." },
{ title: "Verify the BTC address each session", body: "Before sending any Bitcoin, confirm the merchant address matches the one you used last session. Phishing clones will substitute their own address." },
{ title: "localStorage is not encrypted at rest", body: "Your browser's localStorage is readable by JavaScript from the same origin. Do not store high-value secrets here beyond what the app requires." },
{ title: "One-confirmation BTC threshold", body: "The deposit system credits after 1 confirmation — fast but not fully final. For large amounts, wait for 6 confirmations before spending the credited USD." },
{ title: "Operator must configure .env", body: "MERCHANT_BTC_ADDRESS and optional NEXT_PUBLIC_BITCOIN_CHECKOUT_URL must be set in .env.local. Without these, Bitcoin verify returns a config error." },
].map((item) => (
<div key={item.title} className="rounded-xl border border-gray-800 p-5">
<div className="mb-2 font-bold text-red-300">{item.title}</div>
<p className="text-sm text-gray-400">{item.body}</p>
</div>
))}
</div>
<div className="mt-8 text-center">
<Link href="/arb-academy" className="text-sm text-red-400 hover:underline">ARB Academy for more </Link>
</div>
</div>
</section>
<footer className="border-t border-gray-800 px-4 py-8 text-center text-sm text-gray-600">
<p>CyberLux Architecture Breakdown · Honest technical documentation · No fabricated audit results</p>
<div className="mt-2 flex justify-center gap-6">
<Link href="/" className="hover:text-gray-300">Hub</Link>
<Link href="/trust" className="hover:text-gray-300">Trust Dashboard</Link>
<Link href="/reviews" className="hover:text-gray-300">Reviews</Link>
</div>
</footer>
</div>
);
}
}