The backend is a NestJS application with TypeORM and scheduled jobs.

Runtime modules

AppModule imports the runtime modules below.
ModuleArea
ConfigModuleEnvironment parsing and runtime configuration
ScheduleModuleScanner and interpretation intervals
TypeOrmModulePostgreSQL connection, entities, migrations
BlockchainModuleChain metadata
ContractsModulePool contracts and keys
AssetsModuleAsset metadata
ApplicationsModuleApplications and route segments
ScannerModuleStellar/Solana scanner providers and scheduled scanner service
AuditModuleRaw audit rows and audit query endpoint
AuditInterpretationModuleInterpretation worker and interpreted records
AuthModuleGET /auth/me, permissions, guards
WorkosAuthModuleWorkOS identity implementation
MagicAuthModuleOTP authentication implementation
AdminsModuleOrganization, team, and access administration
CasesModuleCase requests, approvals, case review, assignments
DisclosureRequestModuleDisclosure request storage and status model
ReportsModuleReport generation, listing, download
AuditorsLogModuleActivity-log staging, persistence, list, export

Backend component map

API groups

Representative API groups:
API groupExample routeMain checks
AuthGET /auth/meAuthenticated identity
ApplicationsPOST /api/applications, GET /api/applicationsOwner application permissions
ContractsPOST /api/contractsAuth and contract-management checks
Audit rowsGET /api/audit/contract/:contractIdreports:view_transactions
Cases/api/applications/:foreignId/cases/...Application scope, case permissions, assignments
Admin case decisions/api/applications/:foreignId/case-requests/:id/approvecases:approve_creation
Reports/api/reports, /api/applications/:foreignId/reports, /api/applications/:foreignId/case-reportsreports:create, reports:list, reports:download
Activity log/api/auditors-log, /api/applications/:foreignId/auditors-log, /api/applications/:foreignId/cases/:caseId/auditors-loglogs:view_activity or reports:view_transactions
Team/admin/api/admin/team/...Organization owner and team-management checks

Scheduled jobs

JobServicePurpose
Stellar scanner tickLedgerScannerSchedulerService -> StellarLedgerScannerServiceScan configured Stellar chain names for registered contracts
Solana scanner tickLedgerScannerSchedulerServiceScan configured Solana chain names through the Solana path
Interpretation batchAuditInterpretationRunnerServiceLock uninterpreted rows and write normalized interpretation rows
The Stellar/Soroban pages focus on the Stellar privacy-pool scanner. The Solana confidential-token path shares backend workflow tables after normalization but is a separate chain adapter.

Enforcement surfaces

Server-side enforcement uses:
MechanismPurpose
WorkosAuthGuardVerifies authenticated session/JWT
PermissionsGuardChecks required permission keys
ApplicationScopeGuardResolves :foreignId and attaches internal applicationId
ExternalAuditorScopeGuardRestricts external auditor access where used
Query-level org/application filtersPrevent cross-organization and cross-application reads
Case assignment checksRestrict case review to assigned auditors
Case access-window checksEnforce access_days expiration
Client-side permission checks shape navigation. API guards and scoped queries are the source of truth.