# 👁️ AiA · Advanced Intelligence Academy

A security & AI learning platform plus a suite of legitimate tools, built to operate strictly
within legal and ethical bounds. No accounts, no trackers, no external dependencies — just
open `index.html`.

> **AiA · Advanced Intelligence Academy** — founded by **Husnu Konak** & **Adam Milankovic**.
> AiA and its Professional Diploma in Cybersecurity are produced by AiA.

---

## Quick start

**Option A — open directly**
Double-click `index.html`. Everything works except the two live-data tools, which need
a server origin to call public APIs (browsers block `fetch` from `file://`).

**Option B — run the local server (recommended)**

```bash
# Python (no install needed)
python3 serve.py
# → opens http://localhost:8000/index.html

# or with Node
npm start          # uses serve.py
npm run serve      # uses npx http-server
npm run serve:node # pure-Node fallback, no extra packages
```

---

## The tools

| Page | What it does | Notable features |
|------|-------------|------------------|
| `index.html` | Home hub | Theme toggle, responsive nav, stats |
| `academy.html` + `course.html` | **Academy** — 6 courses across cyber sectors | Lessons, objectives, interactive scored quizzes, saved progress (content in `courses.js`) |
| `pentest-portfolio.html` | Authorized pentest portfolio + **Rules-of-Engagement generator** | Consent gating, printable/PDF RoE document, in/out-of-scope fields |
| `breach-check.html` | **Privacy-first breach checker** | k-anonymity (SHA-1, 5-char prefix), live strength meter + entropy, secure password generator |
| `cve-dashboard.html` | **CVE lookup for defenders** (live NVD API) | Keyword/CVE-ID search, severity filter, **CSV export** |
| `dns-check.html` | **Email & DNS security checker** (live DNS-over-HTTPS) | SPF / DMARC / DKIM / MX analysis, posture score, fix suggestions |
| `ctf-lab.html` | Learn offensive security **legally** | Platforms, isolated home-lab build, roadmap with **saved progress tracker** |
| `ai-compare.html` | **Honest AI model comparison** | Sortable/filterable table of 16 models, **CSV export** |

## Professional Diploma Program (NEW — structured, leveled)

A full, progressive program with **stackable credentials** and a capstone — defined in
`curriculum.js` (content) and `quizzes.js` (assessments), shown on `program.html`, with
each course rendered by `course2.html?c=<id>`.

**13 courses · 40 modules · 120 lessons · 3 levels**

| Stage | Level | Credential | Courses |
|-------|-------|-----------|---------|
| 1 · Foundation Certificate | 🟢 Beginner | AiA Foundation Certificate | Cyber Foundations · Networking Essentials · OS & Command Line · Core Principles & Risk |
| 2 · Practitioner Diploma | 🔵 Intermediate | AiA Practitioner Diploma | Network Defense · App & Web Security · Cryptography & Identity · Cloud Security · Security Operations |
| 3 · Advanced Diploma | 🟣 Advanced | AiA Advanced Diploma | Offensive Security · DFIR · OT/IoT & Critical Infrastructure · Governance, Risk & Leadership |
| Final | — | + Capstone Project | Threat model → authorized pentest → hardening → IR runbook → exec briefing |

Each course has: a level badge, **prerequisites**, learning outcomes, **multi-module
structure** (each module = overview + detailed lessons + key takeaways), a 5-question
assessment (80% to pass), and a certificate. The `program.html` roadmap shows stage
progress, careers per stage, credentials earned, and the capstone with its rubric.
Every course/lesson/quiz/certificate progresses and persists via `localStorage`.

## The Alignment Thread (woven through every module)

AI alignment is introduced from **lesson 1** and runs as a short **Alignment Thread**
section in **all 40 modules** of the diploma (`alignment-threads.js`), connecting each
security topic to AI safety. The journey culminates in the required flagship course
**AI Alignment: Ensuring AI Benefits Humanity** (`alignment.html` + `alignment.js`) — a
12-week, 7-module course with module-progress tracking, resources, weighting and glossary.
The goal: every graduate is equipped for the digital, cyber **and** AI worlds, confidently aligned.

## Program resources

- **Course Catalog (`catalog.html`)** — the complete syllabus auto-generated from the
  curriculum: every stage, course, module outline, learning outcomes and assessment.
  Includes a print-optimised stylesheet (🖨️ Print / Save as PDF).
- **Glossary (`glossary.html` + `glossary.js`)** — 69 key security terms, searchable and
  filterable by category, with live highlighting.
- **Program Handbook / FAQ (`faq.html`)** — getting-started steps, quick links, how grading
  and the three certificate tiers work, careers, ethics and common questions.

## Academy library — 7 standalone sector courses

Data-driven from `courses.js`; `academy.html` lists them, `course.html?c=<id>` renders one.

1. 🛰️ **Network Security** — Infrastructure & Defense
2. 🧬 **Application & Web Security** — Software & Product Security
3. ☁️ **Cloud Security** — Cloud & Platform Engineering
4. 🔬 **Digital Forensics & Incident Response** — Blue Team & Operations
5. 📜 **Governance, Risk & Compliance** — Strategy, Risk & Audit
6. 🏭 **OT, IoT & Critical Infrastructure** — Industrial & Embedded Security
7. 🔑 **Cryptography & Identity** — Trust, Identity & Access

Each has learning objectives, multi-module lessons, and a 5-question interactive quiz
(80% to pass). Lesson completion and quiz scores persist in `localStorage`.

**Academy-wide search:** the search bar on `academy.html` indexes every lesson across all
courses and deep-links straight to the matching lesson.

**Certificates of completion:** finish all lessons and pass the quiz (80%+) to unlock a
printable / save-as-PDF certificate with your name, score, date and a unique certificate ID.

**Transcript (`transcript.html`) — diploma dashboard:** shows overall diploma progress, a
**Master Diploma** banner (unlocks when all 13 courses are done), **three stackable stage
credentials** (Foundation / Practitioner / Advanced) each with its own printable credential
certificate, and a per-course table grouped by stage with re-printable course certificates.
Includes a **demo-data toggle** (auto-on when there's no real progress, e.g. in the sandbox
preview), JSON export, and reset. Three certificate tiers are generated client-side:
per-course, per-stage credential, and the gold **Master Diploma**.

## Serverless proxy (makes live tools work on static hosts)

Static hosting can't call some third-party APIs directly due to CORS. This project
ships a tiny **allow-listed** proxy so the breach, CVE, and DNS tools work anywhere:

- `api/proxy.js` — Vercel-style function (config in `vercel.json`)
- `netlify/functions/proxy.js` — Netlify function (config in `netlify.toml`)
- `serve.py` — the local server implements the **same `/api/proxy` endpoint** in pure Python

The front-end automatically tries `/api/proxy` first and falls back to a direct call.
The proxy is **strictly allow-listed** (HIBP range, NVD, Google DNS, read-only header
checks only) so it can't be abused as an open proxy / SSRF tool.

**Deploy:**
```bash
vercel deploy        # or: connect the repo at vercel.com
netlify deploy --prod  # or: connect the repo at netlify.com
```

---

## Why each tool is ethical by design

1. **Consent first** — the pentest tool won't generate a request without authorization
   attestations, and produces a document explicitly marked invalid until signed.
2. **Your data only** — the breach checker uses k-anonymity (your password never leaves
   your device) and *deliberately refuses* arbitrary third-party email lookups, which
   would enable doxxing/stalking.
3. **Public defensive data** — CVE info comes from the official NIST NVD to help
   defenders patch faster.
4. **Transparent AI** — comparisons cite measurable specs (context, price, SWE-bench),
   not marketing claims.

---

## Technical notes

- **Live APIs:** `breach-check.html` → `api.pwnedpasswords.com`; `cve-dashboard.html`
  → `services.nvd.nist.gov`. Both are free and need no key. The in-app sandbox preview
  has **no network**, so use the local server or a normal browser for live data.
- **No build step, no `node_modules`:** everything is plain HTML/CSS/JS with inline styles
  so pages render correctly even in restricted preview sandboxes.
- **Theme & progress** persist via `localStorage`.

## License

MIT — for educational and professional use. Always operate with explicit authorization
and within the law.

## Governance & backend docs
- **GOVERNANCE.md** — maps each sector-portal feature to the Australian obligation it supports (feature → obligation, per-sector, audit flow).
- **BACKEND.md** — turnkey spec for the Rust · Cloudflare Workers backend: exact routes, request/response shapes, D1 schema, hash-chain parity, and the wiring checklist. Front-end modules already mirror these routes (`live`/`endpoint` flags).