Cyberattack Sunday

Demo

About

Cyberattack Sunday, chain-first: The Graph as the detector for the crypto lane, the newsletter as the consumer, the incident feed sold per query over x402 on Hedera, and graph-evidence packaged as an MCP server so it lands in The Graph's tooling pool. A secure, read-only Google Sheets connector is live-verified against the authorized Cyberattack Sunday workbook. It inventories historical structure without exposing content or modifying the source. Automated row ingestion remains a post-inventory implementation step. Goal was to train it with ~90 weeks of previous content, but ran out of time. Will continue as I do intend to use this daily. I do a Cyberattack Sunday run down on my Substack every single week, that takes me eight hours to manually compile. But my RSS feed can't sort out the cyberattacks from regular cyber news, so I decided to build my own dashboard that could. Goal is to add more filtration to help manage my news channel. The system includes deterministic classification, incident clustering, evidence correlation and drafting, with chain evidence from The Graph and an MCP interface. I also built a secure, read-only Google Sheets connector and verified it against my authorized 83-tab historical workbook. The 23,910-row corpus validates cleanly, although completing its production ingestion remains the immediate post-submission infrastructure step.

How it's made

pnpm & Turborepo monorepo Next.js dashboard Node.js & PostgreSQL deployed on Railway mapped out the architecture, then divided the project into audited sprints (don't laugh, I just found out how to make a proper Sprint thanks to this so... thanks!) first sprints established the repository, threat model, data lineage and PostgreSQL foundation then I started on the classification engine, which still needs calibrating The system includes deterministic classification, incident clustering, evidence correlation and drafting, with chain evidence from The Graph and an MCP interface. I also built a secure, read-only Google Sheets connector and verified it against my authorized 83-tab historical workbook. The 23,910-row corpus validates cleanly, although completing its production ingestion remains the immediate post-submission infrastructure step. The Graph became the chain-first detector for the crypto lane. I used it to collect standardized protocol observations across Ethereum and Base while preserving the provider, deployment, block and query provenance. I then packaged the graph-evidence layer as a bounded, read-only MCP server so the same incident and anomaly tools can eventually participate in The Graph’s tooling ecosystem. The commercial destination is to make the reviewed incident feed available per query through x402 settlement on Hedera, although that payment layer remains future work. The Google Sheets integration was added last because I wanted the application connected to exactly one workbook, not my entire Google Drive. (Second last. These login creds are driving me insane, making a last minute switch to no logins!) The development process deliberately alternated implementation with adversarial review. Claude built each bounded sprint, while Codex independently reproduced failures against compiled commands, disposable PostgreSQL databases and hostile inputs before a sprint was accepted. That cycle uncovered issues including stale database snapshots, mutable completed records, search-path shadowing, path traversal, symlink races, cancellation leaks, redirect handling and secret-encoding leaks. Fixes were regression-tested through offline suites, PostgreSQL integration tests, browser tests, network-denial tests, migration rollback checks, CodeQL and continuous integration. I did not finish training or evaluation against approximately 90 weeks of published Cyberattack Sunday material before the deadline. What I completed is the foundation: traceable inputs, deterministic decisions, incident construction, evidence-aware drafting, human review, a production dashboard and a live-verified connection to the historical workbook. I intend to continue building it because it is designed around a workflow I perform every week and a tool I genuinely plan to use daily.