Internal Tool

Application Security Dashboard

I designed and built an internal application security platform that unified ticket management, code review, dependency analysis, and security investigations into a single workspace.

Northstar Security is an internal application security platform created to consolidate the tools and workflows used throughout the software security review process. Instead of moving between separate applications for ticket management, static analysis, merge request reviews, dependency investigations, and threat analysis, security engineers can complete investigations within a consistent interface designed around evidence-driven decision making. As the sole designer and developer, I was responsible for the product vision, user experience, interface design, and implementation of the platform. The portfolio recreates the application's interface using fictional branding to protect confidential information while accurately representing the workflows, architecture, and design decisions behind the original system.

Role

Designer & Developer

Status

Internal Security Tool — Screens recreated for confidentiality.

Project type

Internal Tool

Primary discipline

Security

Year

2026

Scope

Security workflow design

Audience

Security and engineering teams

Focus

Visibility and prioritization

Signal areas

Core views

Split-view Northstar Security case-management dashboard with a ticket queue and active investigation workspace. — Concept interface for a calmer, more actionable application security workflow.

Application security programs often fail at the last mile of communication. Findings exist, but they are fragmented across tools, hard to prioritize, and disconnected from the people expected to act on them.

This concept reframes the problem as a product experience challenge: create one interface that helps teams understand what matters, why it matters, and where attention should go next.

Context

Reducing friction across the security workflow

Application security work is fragmented by default. Tickets live in one system, code changes in another, findings in scanner interfaces, traffic evidence in logs, and working notes somewhere else entirely. The analyst must continually reconstruct context while moving between them.

That fragmentation creates more than inconvenience. It makes it harder to maintain a clear investigative thread. A finding may look serious in a scanner but prove unreachable in the application. A dependency may carry a high severity rating but never execute in the vulnerable context. A suspicious request may resemble an attack without representing meaningful risk. Reaching the right conclusion depends on evidence distributed across several systems.

The opportunity was to create an internal product that supported the way security decisions are actually made. Rather than displaying more alerts, the tool needed to help an analyst gather context, examine evidence, record reasoning, and move toward a decision without repeatedly rebuilding the investigation.

The challenge was not simply technical integration. Each workflow had different information needs. Code review required readable diffs. Static-analysis review required source context and false-positive reasoning. Dependency analysis required reachability and runtime evidence. Traffic investigation required filters, request details, and pattern analysis. The system needed consistency without flattening those differences.

Approach

Designing around evidence and decisions

I designed Northstar around a simple sequence: Question → Evidence → Decision

Each workspace begins with a specific security question rather than a collection of undifferentiated metrics. The interface then places the evidence needed to answer that question beside the relevant code, ticket, package, or event. Recommendations and analyst actions appear only after the supporting context.

This led to a modular product architecture. The overview helps users decide what requires attention. Case Management keeps ticket context, notes, and related merge requests together. Merge Request Analysis centers the code diff. Dependency Intelligence organizes exploitability evidence into expandable sections. Threat Investigation retains the detailed event table and investigation accordion rather than replacing them with executive-level charts.

I also treated AI as a supporting capability rather than the visual centerpiece. AI-assisted summaries and investigation guidance are integrated into the workflow, but the interface continues to foreground code, logs, findings, package behavior, and analyst reasoning. The goal is not to ask users to trust an automated answer. It is to help them reach and document a better-supported conclusion.

A consistent visual system ties the modules together: dark neutral surfaces, restrained emerald accents, clear information hierarchy, rounded panels, and generous spacing. The portfolio recreations refine that language while preserving the original workflows. Proprietary terminology was replaced with fictional, internally consistent content rather than using redaction bars that would obscure how the product functions.

Design Principles

Preserve the workflow The recreated screens retain the underlying layout, information relationships, and investigative sequence of the original tool.

Make evidence the hero Code, logs, traffic, findings, and contextual analysis receive more visual weight than AI branding or decorative analytics.

Give each workspace a question Every module is organized around a practical decision the user needs to make.

Maintain consistency without forcing uniformity Navigation, typography, panel behavior, and visual hierarchy remain consistent, while each workspace keeps the structures its evidence requires.

Keep analyst judgment visible Recommendations support the analyst’s decision rather than presenting the system as an autonomous authority.

Features

One platform, six connected security workspaces

Detail

CONFIGURABLE SECURITY OVERVIEW

The overview is organized around user-defined saved queries rather than fixed system metrics. Users can configure the views they want to monitor and surface them as cards on the dashboard, making the starting screen adaptable to different responsibilities and review patterns. A centered Ask Northstar field provides a natural-language entry point for questions and investigations. Beneath the saved views, Recent Activity gathers updates from tickets in which the user is involved, while My Tickets provides a direct view of currently assigned work. This makes the overview less of an executive reporting page and more of a personalized operational workspace: what do I want to monitor, what changed, and what requires my attention?

Detail

CASE MANAGEMENT

Case Management uses a split-view layout with the ticket queue on the left and the active workspace on the right. This allows analysts to move between cases without losing the structure of the current review. The workspace preserves separate sections for Overview, Details, Notes, and Merge Requests. Rather than translating ticket content into simplified cards, the interface retains the density and hierarchy needed for active casework. Private notes allow analysts to record reasoning and investigation details alongside the source ticket without changing the external record prematurely. The result is a working environment for security cases rather than a passive ticket viewer.

Detail

SECURITY INVESTIGATION WORKSPACE

The Security Investigation Workspace supports the review of scanner findings, including potential false positives. Source code remains the primary focus, while the adjacent investigation panel organizes the reasoning needed to evaluate the result. The workflow is designed to answer a specific question: is this finding real in the context of the application? Analysts can inspect the relevant code, review supporting evidence, and document the basis for a decision without treating scanner severity as the conclusion. AI assistance is available inside the investigation, but the interface keeps the code and evidence visually dominant.

Detail

MERGE REQUEST ANALYSIS

Merge Request Analysis connects a review queue, code diff, investigation evidence, and final recommendation in one workspace. The code change is treated as the central object rather than being reduced to a summary card. The investigation panel captures security-relevant observations while preserving the relationship between those observations and the changed lines. This gives the reviewer a clearer path from code inspection to merge recommendation. The module supports a natural progression: Merge Request Queue → Code Diff → Investigation Summary → Merge Recommendation

Detail

DEPENDENCY INTELLIGENCE

Dependency Intelligence moves beyond package severity by organizing the evidence required for exploitability analysis. Instead of summarizing the result into a single risk score, the workspace exposes the investigation through expandable evidence sections. These sections can include Package Verification, Import Discovery, Runtime Reachability, Data Flow Analysis, Environment Context, Mitigating Controls, Confidence Justification, and Recommendation. This structure makes the reasoning inspectable. A user can see not only the conclusion, but which evidence supports it and where uncertainty remains.

Detail

THREAT INVESTIGATION

Threat Investigation supports the review of potentially malicious application traffic. The workspace retains both the investigation accordion and the detailed event table, avoiding the common mistake of replacing operational evidence with high-level dashboard visualizations. Evidence is organized into sections such as Threat Assessment, Detection Evidence, Response Analysis, Traffic Pattern Analysis, Geographic Context, Burst Detection, Payload Inspection, and Recommendations. Filters allow analysts to narrow the event set, while the export basket supports collection of relevant evidence. The interface keeps the investigative sequence intact: Evidence Review → Filtering → Event Inspection → Evidence Collection

Detail

CONNECTED INTERNAL WORKFLOW

Northstar was designed to bring together information from development, ticketing, security-scanning, and log-analysis workflows. Quick-access patterns, split views, notes, filters, and linked investigation panels allow users to move through the work while maintaining context. The platform also supports reusable workflow elements such as ticket templates, batch actions, and the ability to incorporate additional internal analysis utilities. These features extend the product beyond visualization and into daily operational use.

Evidence

Screens and supporting views

Dark security platform overview with a natural-language search field, four customizable saved-query cards, recent activity, and assigned tickets. — A personalized starting point built around saved queries, current work, recent changes, and direct access to natural-language investigation.

Security code-review workspace showing a merge-request queue, source-code diff, investigation evidence, and merge recommendation. — The merge-review workspace keeps code changes, supporting evidence, and the final recommendation in one continuous review flow.

Dependency vulnerability investigation interface with package details, exploitability evidence accordions, and a security recommendation. — Exploitability is evaluated through inspectable evidence including package verification, import discovery, runtime reachability, environment context, and mitigating controls.

Threat-analysis interface containing expandable evidence sections, traffic filters, event records, and an evidence export basket. — Suspicious traffic can be filtered, inspected, contextualized, and collected while the underlying event evidence remains visible.

Static-analysis investigation screen with source code, finding information, and a right-side evidence panel for false-positive review. — Static-analysis findings are reviewed against the surrounding source code and documented evidence rather than accepted solely on scanner output.

Split-view security case-management interface with a ticket queue and a workspace containing overview, details, notes, and merge-request sections. — Tickets, internal reasoning, case details, and related development activity remain connected inside a persistent two-pane workspace.

Simple workflow diagram showing the Northstar investigation sequence: Question, Evidence, and Decision. — Every workspace follows a shared product model: begin with a security question, gather relevant evidence, and document a defensible decision.

Outcomer

A connected foundation for application security work

Northstar resulted in a functioning internal web application that brought several recurring application security activities into one product environment. The project established a shared interaction model across workflows that previously required different systems, evidence formats, and review patterns.

Rather than standardizing every task into the same dashboard, the system provides purpose-built workspaces connected through a consistent product language. This allows code, dependency information, traffic evidence, tickets, notes, and recommendations to remain structured around the decisions they support.

The work also created a foundation for continued expansion. New analysis utilities, integrations, templates, and investigation workflows can be added without abandoning the core product model.

Outcomes • Consolidated multiple application security workflows into one internal web application. • Created dedicated workspaces for tickets, code findings, merge requests, dependencies, and traffic investigations. • Preserved evidence and analyst reasoning alongside recommendations. • Introduced a consistent interaction model across different forms of security analysis. • Added user-configurable saved views rather than imposing a fixed dashboard. • Integrated AI assistance without making automated output the sole basis for decisions. • Created a modular foundation that can support additional security tools and workflows. • Demonstrated sole ownership across security strategy, UX, product design, and software development.