Evidence-first security research and authorized assessment engineering by Silentium Labs.
Arcana Framework is an end-to-end security assessment and evidence workflow designed around:
scope → reconnaissance → validation → evidence → findings → remediation → reporting
Automated scanner output is a lead. A finding is something an analyst can prove.
Arcana connects the parts of an authorized assessment that are usually scattered across tool output, screenshots, notes, browser sessions, evidence folders, and report documents. It gives analysts a controlled path from an approved target to a defensible result—without confusing automation with proof.
Important
This repository is a public-safe product and research showcase. It contains a non-networked Arcana X demonstration, sanitized architecture, fictional evidence, and reporting examples. It does not contain the private Arcana engine, production worker internals, exploit logic, real assessment evidence, or Silentium Labs infrastructure.
An assessment is only useful when its scope is exact, its evidence survives scrutiny, and its findings describe demonstrated risk. Arcana is built around six controls:
| Control | What it means |
|---|---|
| Exact scope | Every target is registered against an authorization reference before assessment work begins. |
| Controlled profiles | Analysts choose conservative, reviewable assessment stages appropriate to the engagement. |
| Evidence integrity | Artifacts are organized per job and tracked with integrity metadata. |
| Analyst validation | Automated output stays in review until an analyst can support the claim with evidence. |
| Remediation lifecycle | Findings move through remediation and retest instead of ending at report delivery. |
| Structured reporting | Verified findings, evidence references, impact, and remediation remain connected. |
Arcana X is the visual operations surface for Arcana. It is designed as an analyst workstation: dense, restrained, auditable, and deliberately free of theatrical “cyber” styling.
The public demo includes:
- Operations Overview
- Scope Registry and authorization controls
- Mission Builder with controlled assessment profiles
- Reconnaissance and Services inventory
- Findings validation workflow
- Evidence Library with SHA-256 integrity state
- Report composition and remediation status
- Activity and policy audit views
The demo is static by construction. It imports fictional fixtures, has no backend, and performs no target requests, scanning, shell execution, socket activity, exploitation, telemetry, or analytics. A restrictive Content Security Policy blocks outbound connections at the page level.
Run it locally:
cd demo
pnpm install
pnpm run devSee demo/README.md for the safety model and verification commands.
flowchart LR
A["Scope<br/>authorization + exact targets"] --> B["Reconnaissance<br/>asset + service leads"]
B --> C["Validation<br/>analyst review"]
C --> D["Evidence<br/>artifacts + integrity"]
D --> E["Findings<br/>impact + confidence"]
E --> F["Remediation<br/>owner + retest"]
F --> G["Reporting<br/>structured outputs"]
Raw output is allowed to be incomplete, ambiguous, or wrong. Findings are not. Arcana preserves that separation throughout the workflow.
Arcana’s public architecture describes responsibilities and trust boundaries—not private transport, storage topology, worker implementation, or production configuration.
flowchart TB
AX["Arcana X<br/>scope · missions · findings · reports"]
OP["Authorized operations plane<br/>exact scope · profiles · job policy"]
RW["Restricted worker boundary<br/>allowlisted stages · conservative execution"]
EP["Evidence pipeline<br/>artifacts · integrity · normalized metadata"]
AV["Analyst validation<br/>review · proof · impact · remediation"]
RP["Structured reporting<br/>verified findings · evidence references"]
AX --> OP --> RW --> EP --> AV --> RP
Read the full public architecture, feature map, and publication boundary.
Arcana became one of the foundational engineering projects behind Silentium Labs and helped shape its approach to vulnerability research, independent validation, evidence integrity, responsible disclosure, and security automation.
Silentium Labs has conducted research submitted and coordinated through CISA’s VINCE platform. Public-safe research areas have included:
- internet-exposed Veeder-Root / automatic tank gauge systems; and
- internet-exposed Orthanc / DICOM healthcare systems.
Arcana supported the assessment and evidence workflow used during security research. This statement does not imply that CISA endorses, certifies, approves, or owns Arcana, Silentium Labs, or this repository. No claim is made that Arcana discovered a particular CVE.
Read the research history and public-safe case studies for Veeder-Root / ATG exposure and Orthanc / DICOM exposure.
| Included here | Kept private |
|---|---|
| Public-safe architecture and workflow concepts | Complete Arcana core and proprietary implementation |
| Fixture-only Arcana X interface | Production controller and worker configuration |
| Fictional targets, findings, and evidence | Client data, real targets, credentials, and assessment evidence |
| Sanitized case-study summaries | Unpublished vulnerability details and private disclosure correspondence |
| Sample reports and remediation language | Exploit chains, payload logic, stealth/evasion behavior, and operational access details |
| Security, contribution, and responsible-use policies | Private infrastructure, endpoints, transport details, and storage topology |
The complete rules live in docs/PUBLICATION_BOUNDARY.md.
arcana-framework/
├── architecture/ Public component and trust-boundary notes
├── branding/ Arcana visual language
├── case-studies/ Sanitized, non-reproduction research summaries
├── demo/ React + TypeScript fixture-only Arcana X demo
├── docs/ Product, safety, research, and publication docs
├── media/ Sanitized screenshots and repository visuals
├── samples/ Fictional evidence and structured sample reports
├── CHANGELOG.md
├── CONTRIBUTING.md
├── LICENSE_NOTICE.md
├── RESPONSIBLE_USE.md
├── ROADMAP.md
└── SECURITY.md
Arcana is intended only for systems you own, systems you are explicitly authorized to assess, approved research programs, and controlled labs. See RESPONSIBLE_USE.md and SECURITY.md.
No open-source license has been selected for this repository. LICENSE_NOTICE.md remains authoritative until Silentium Labs explicitly chooses which portions, if any, to license.
Public contributions should strengthen documentation, interface quality, safe reporting, evidence handling, or defensive workflow design. Every contribution is subject to the same security and publication review described in CONTRIBUTING.md.
Arcana Framework · Silentium Labs
Controlled research. Defensible evidence. Findings that can be proved.