Owner authentication
scrypt password hashing, a TOTP second factor, replay prevention, attempt throttling and revocable sessions. Enrollment is prepared, checked and explicitly confirmed.
Independent project · France
Trust starts
with
evidence.
OVE Cyber Shield. A local application security project developed to make authentication and security logging more explicit, understandable and verifiable.
Independent working version. Technical validation is being prepared. No Google certification or endorsement.
MULTIFACTOR AUTHENTICATIONLOCAL STORAGESECURITY LOGGINGCONCEPT DIAGRAM · NO REAL DATA
01 / THE APPROACH
A clear scope.
Explicit controls.
Separated from OVE Studio IDE, Cyber Shield now has its own working source files, interface and storage. The editor, terminal, Codex and remote deployment are outside the standalone application's scope.
Security journal
Authenticated access, predefined messages, rotation and storage limits. A write incident blocks operations that require an available journal.
Backup preparation
AES-256-GCM encryption, scrypt derivation and path validation. Restoration is designed to use a new destination without overwriting existing data.
This project provides local application controls. It is not presented as antivirus or EDR software and does not protect against malicious software running with the same Windows privileges. Portable recovery of a real owner account is not delivered.
02 / TECHNOLOGY
A readable architecture.
A measured ambition.
The following technologies are declared in the working source. Dependencies still need installation, a dedicated lockfile and validation for the independent version.
TypeScript · Next.js · React
Interface and security routes, separating presentation, authorization and local services.
Node.js · Cryptography
scrypt for passwords and fictitious archives; TOTP for the second factor; AES-256-GCM for the preparatory backup format.
Windows · DPAPI
Windows profile-bound protection is implemented in the code. No DPAPI test of the standalone version has been performed.
HTTP · Sessions · CSRF
Host and origin checks, bounded JSON requests, session cookies and CSRF tokens. Local, single-process operation remains to be validated.
03 / TECHNICAL TRANSPARENCY
State what was checked.
And what was not.
The initial stage consisted of source review and static checks. These figures are neither a comprehensive security audit nor functional test results.
Initial technical review
STATIC CHECKS21files successfully checked
for supported syntax
for supported syntax
9files awaiting checks
with appropriate tooling
with appropriate tooling
5fictitious test cases prepared
and not executed
and not executed
Five JSON configurations are parseable. Text-based import inspection found no missing local references or references outside the root. This does not replace the TypeScript resolver. No functional tests, production build or DPAPI validation of this version are claimed.
Dependency audit and licenses
A dedicated lockfile, final software bill of materials and actual license texts remain pending. Inherited declarations do not verify the components eventually distributed. No current comprehensive vulnerability audit is available.
Known limitations and hardening work
Strict persistent-state validation, journal resumption, launcher environment, Windows ACLs, filesystem races and content security policy require review. Archive hashes cannot protect against an actor able to change both the data and its hashes.
Historical studio results are separate
Previous validations concern OVE Studio IDE and do not certify the independent application. Monaco and its embedded DOMPurify are absent from Cyber Shield's direct dependencies; this does not fix historical studio files.
04 / THE ROADMAP
Next: a reproducible
technical evaluation.
An evidence-based roadmap, with separate authorization for each technical operation.
Stabilize the foundation
Lock dependencies, complete the software inventory and licenses, check types and build the independent version.
Exercise the controls
Run approved fictitious tests, validate the browser workflow, then assess DPAPI and recovery in a dedicated setting.
Invite independent review
Prepare evidence and a confidential evaluation scope, then submit a reviewed deliverable only with explicit authorization.
05 / AN INVITATION TO DIALOGUE
Technology.
Trust.
People.
Nouvel Air Lab Studio is the project led by Adrien Caillet, its founder and the creator of OVE Cyber Shield, based in France.
This presentation is addressed to Google France to propose a technical evaluation and explore a possible collaboration if there is interest.
Proposed first step: discuss the evaluation scope, review criteria and confidentiality arrangements. This website provides no access to private source code.
A collaboration built on trust
If OVE Cyber Shield attracts your interest and a collaboration becomes possible, I would hope that our discussions could be grounded in trust, transparency and mutual respect.
I would welcome proposals and any eventual agreements being formalized through official correspondence.
I would also be pleased if a meeting could be arranged with my wife, Élodie, present, so that she could take part in the discussion and share this important moment with me.
I would be particularly honored to receive an official invitation from Google France by post, in the form of a carefully presented letter on company letterhead, dated and signed by a representative of your company.
At a time when technology plays an increasingly important role, I remain deeply attached to human relationships, sincere dialogue and the value of traditional correspondence.
Beyond the technical and professional aspects, I hope this initiative can first and foremost be a meeting between people who share a desire to put technology at the service of humanity.
Thank you sincerely for the attention you may give to my work and to this proposal.
Adrien CailletFounder of Nouvel Air Lab Studio
Creator of OVE Cyber Shield · France
Creator of OVE Cyber Shield · France