This is a submission for the DEV Weekend Challenge: Community The Community Nepal has thousands of small Christian fellowship churches — most run entirely by volunteers with no technical background. Every Saturday, a church a…

Sichere Programmierung dev.to 02.03.2026, 11:24 Uhr 3 Min. Lesezeit KRITIS / Energie

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

STANDARD — Regulärer Patch-Zyklus ~3 Min. (498 W.)

Deep Tech

Kairos This is a submission for the DEV Weekend Challenge: Community The Community Nepal has thousands of small Christian fellowship churches — most run entirely by volunteers with no technical background.

Angriffsfläche

PostgreSQL / MySQL

Exploit-Status

Geringe Ausnutzungswahrscheinlichkeit / Keine aktiven Kampagnen

Sofortmaßnahme

Asset-Inventar prüfen & Upstream-Advisory überwachen

This is a submission for the DEV Weekend Challenge: Community

The Community

Nepal has thousands of small Christian fellowship churches — most run entirely by volunteers with no technical background. Every Saturday, a church anchor (presenter) manually types out the week's presentation: song lyrics in Nepali, Bible verses, sermon details, announcements, and prayer points — usually in PowerPoint.

What I Built

Kairos — Fellowship Builder is an AI-powered church presentation builder designed specifically for Nepali Christian communities.

An anchor fills in a simple form:

Fellowship date

Anchor name and sermon leader

Song lyrics (fetched automatically from a Nepali Christian songs library)

Bible references

Announcements and prayer points

Demo

kairos-weld.vercel.app

Code

BishalSunuwar202
/
Kairos

Kairos

A church fellowship presentation builder. Fill in your fellowship details — anchor name, sermon leader, song lyrics, Bible verse, announcements, and prayer points — and Claude AI generates a structured, slide-by-slide presentation ready to project fullscreen.

Features

AI-generated slides via Claude (claude-sonnet-4-6) using the Vercel AI SDK

Fullscreen presenter mode with keyboard navigation (arrow keys, Escape)

Upload a lyrics image — Claude extracts the text automatically

Save and manage presentations (Prisma + Supabase PostgreSQL)

Google OAuth sign-in via Supabase Auth

Stack

Next.js 16 (App Router) + TypeScript

Vercel AI SDK + @ai-sdk/anthropic

Prisma 6 ORM → Supabase PostgreSQL

Supabase Auth (Google OAuth only)

Zustand for slide/presenter state

Tailwind CSS v4 + shadcn/ui

Setup

Clone and install:
```
npm install
```

Copy .env and fill in your values:

ANTHROPIC_API_KEY=sk-ant-...

NEXT_PUBLIC_SUPABASE_URL=https://xxx.supabase.co

NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJ...

DATABASE_URL=postgresql://...

Run Prisma migration:
```
npx prisma migrate dev --name init
```

Start…

View on GitHub

How I Built It

Tech stack:

Framework - Next.js 16 (App Router)

AI - Gemini 2.5 Flash Lite via Vercel AI SDK (@ai-sdk/google)

Database & Auth - Supabase (PostgreSQL + Google OAuth)

Styling - Tailwind CSS v4 + shadcn/ui

State - Zustand

Deployment - Vercel

How the AI works:

The form data is sent to a Next.js API route which calls Gemini 2.5 Flash Lite with a carefully engineered system prompt. The prompt instructs the AI to:

Output only valid JSON (no markdown)

Write all slide content in Nepali Devanagari

Transliterate English names into Devanagari

Convert the Gregorian fellowship date into Bikram Sambat calendar in Nepali

Generate a warm, faith-appropriate welcome message in Nepali

Split song lyrics into individual slides per section (Verse 1, Chorus, Bridge, etc.)

Follow a fixed slide order: welcome → host → opening prayer → lyrics → sermon → Bible → announcements → closing prayer

Why Gemini 2.5 Flash Lite:

It handles Nepali Devanagari script accurately, understands Bikram Sambat calendar conversion, and is fast enough for real-time generation of 10–15 slides.

The biggest challenge:

Getting the AI to reliably output parseable JSON while also handling Nepali script, calendar conversion, and name transliteration all in a single prompt. The solution was using generateText (not streaming) and stripping any markdown code fences from the response before parsing.

This was built to solve a real problem for a real community — and it's already being used.

DEV username - BishalSunuwar202

1. Sofort-Triage & Abwehrmaßnahmen

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - Kairos
id: 0eecf1de-f007-432c-a75f-8334159a2551
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Kairos" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Kairos")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*Kairos*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "Kairos"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Anzeige: Elgato Stream Deck mit 15 Tasten um 24 Prozent reduziert

IT Nachrichten

NÄCHSTER BEITRAG 1 Min

Maximale Heckenhöhe in Deutschland: BGH fällt wegweisendes Urteil

IT NachrichtenWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Kairos.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')

Auch interessante Nachrichten Kairos

Thematisch verwandte Begriffe: Kairos · 6 Treffer

Sichere Programmierung DEV Community

Before You Move the Robot, Prove You’re Talking to the Right Robot

vor 4 Tagen 📆 20.09.2026 um 08:40 Uhr

Weiterlesen ↗

Sichere Programmierung DEV Community

AI Didn’t Build My Backend for Me. I Used It as My Copilot.

vor 5 Tagen 📆 20.09.2026 um 00:17 Uhr

Weiterlesen ↗

KI & AI Videos

Julian Goldie SEO: NEW Hermes Kanban Agent is Absolutely INSANE!

Video von Julian Goldie SEO auf YouTube: Get the Agent OS & Hermes Kanban Masterclass 👉 https://www.skool.com/ai-profit-lab-7462/about Want to make money and…

vor 5 Tagen 📆 20.09.2026 um 02:00 Uhr

Weiterlesen ↗

IT Security Nachrichten NYT > Cybersecurity

We’re Not Losing Control of A.I. We’re Giving It Away.

vor 4 Tagen 📆 20.09.2026 um 07:00 Uhr

Weiterlesen ↗

IT Security Nachrichten Google Alert – it security

Red Canary detects unauthorized email access, prevents phishing scheme at Fortune 250 company

vor 5 Tagen 📆 19.09.2026 um 16:15 Uhr

Weiterlesen ↗

Sicherheitslücken (CVE) KitPloit - PenTest Tools!

xalgorix v4.6.78

vor 5 Tagen 📆 19.09.2026 um 21:27 Uhr

Weiterlesen ↗

Videos werden geladen ...

Beiträge werden geladen ...

Videos werden geladen ...

🚀 Auf tsecurity.de entdecken

Kommentare über Kairos

💬 Social News Network

Community Debatte 0 Beiträge

Tags:Noch keine Tags.

Noch keine Diskussion eröffnet

Sei der Erste, der seine Einschätzung oder PoC zu diesem Thema teilt.

🚀 Auf tsecurity.de entdecken

Echtzeit-Radar & Feeds

👥 Community & Social

🕒 tsecurity.de Such-Trends & Chronologie

Kairos

The Community

What I Built

Demo

Code

BishalSunuwar202
/
Kairos

Kairos

Features

Stack

Setup

How I Built It

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

tsecurity.de Cognitive Threat RAG

Auch interessante Nachrichten Kairos

Before You Move the Robot, Prove You’re Talking to the Right Robot

AI Didn’t Build My Backend for Me. I Used It as My Copilot.

Julian Goldie SEO: NEW Hermes Kanban Agent is Absolutely INSANE!

We’re Not Losing Control of A.I. We’re Giving It Away.

Red Canary detects unauthorized email access, prevents phishing scheme at Fortune 250 company

xalgorix v4.6.78

tsecurity.de LIVE

Echtzeit-Radar & Feeds

👥 Community & Social

Kairos

The Community

What I Built

Demo

Code

BishalSunuwar202 / Kairos

Kairos

Features

Stack

Setup

How I Built It

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

Mehr aus dieser Kategorie

tsecurity.de Cognitive Threat RAG

Auch interessante Nachrichten Kairos

Before You Move the Robot, Prove You’re Talking to the Right Robot

AI Didn’t Build My Backend for Me. I Used It as My Copilot.

Julian Goldie SEO: NEW Hermes Kanban Agent is Absolutely INSANE!

We’re Not Losing Control of A.I. We’re Giving It Away.

Red Canary detects unauthorized email access, prevents phishing scheme at Fortune 250 company

xalgorix v4.6.78

tsecurity.de App

BishalSunuwar202
/
Kairos