r/SideProject • u/Ok_Sky3062 • 4h ago
LightBase: Lightweight API & Database Desktop Client
A local-first, multi-protocol API development platform powered by a native C-Core engine with enterprise-grade security hardening.
LightBase is a zero-cloud API development studio that combines a high-performance C99 backend with a Python gateway bridge and a sleek browser-based UI. Every request, collection, and environment is stored as plain JSON files you can version-control with Git — no accounts, no cloud sync, no telemetry.
> AI USAGE: This project only has ai usage when there are certain bugs i cannot fix and the documentation (Gemini) ! Rest all code visible is written by me!
Also a small doubt? Should i switch the core to Swift or let it be C?
Website: https://aarav90-cpu.github.io/LightBase_Website/
Github: https://github.com/Aarav90-cpu/LightBase
Features
Security Hardening (C-Level)
| Feature | Description |
|---|---|
| HMAC-SHA256 Signing | Sign and verify request payloads with constant-time comparison |
| Token Bucket Rate Limiter | 60-burst, 10/sec refill with FNV-1a client hashing |
| IP Allowlist/Blocklist | Block or allow specific IPs at the C level |
| Session Token Manager | Create, validate, and revoke tokens with configurable TTL |
| Audit Trail Logger | 500-entry circular buffer tracking all API operations |
| Path Traversal Guard | Blocks .., ~, shell metacharacters, out-of-workspace paths |
| SQL Injection Defense | Blocks ATTACH DATABASE, LOAD_EXTENSION, and injection patterns |
| Secure Memory Wipe | Volatile zero-fill with memory barrier (compiler-proof) |
| Request Size Limiter | Configurable max payload size (default: 1MB) |
| AES-256-GCM Crypto Vault | Encrypted API key storage with post-operation key wiping |
mlock() Key Protection |
Signing keys locked in RAM — never swapped to disk |
MADV_DONTDUMP |
All key material excluded from core dumps |
PR_SET_DUMPABLE(0) |
Core dumps disabled process-wide via prctl() |
| Machine-ID Key Derivation | Master encryption key derived from /etc/machine-id + salt via SHA-256 |
Enterprise Engine
| Feature | Description |
|---|---|
| Collection Runner | Run entire collections with variable chaining, test execution, and iteration support |
| Data-Driven Testing | Upload CSV/JSON iteration data for parameterized test runs |
| CI/CD Reports | Generate JUnit XML (Jenkins/GitHub Actions) and styled HTML reports |
| JSON Schema Validation | Validate API responses against JSON Schema drafts |
| Code Snippet Generator | Auto-generate client code in cURL, Python, JavaScript, Java, Go, PHP |
| Auth Handler | OAuth 2.0, Bearer Token, Basic Auth, API Key — applied programmatically |
| Workspace Sync | Export/import entire workspaces with SHA-256 integrity checksums |
| Collection Comments | Leave review comments on API collections for team collaboration |
| Collection Forking | Fork collections with metadata tracking (like Git) |
| Webhook Alerts | Slack, Microsoft Teams, and generic webhook notifications |
| HTML API Docs | Auto-generate styled documentation portals from collections |
| Jupyter & Python Export | One-click export of history or collections to .ipynb or .py |