At a glance
- Status
- Live
- Domain
- triage.spijkerman.xyz
- For
- SOC analysts and incident responders
- Platform
- Web, with an optional browser extension
- Stack
- SvelteKit, TypeScript, SQLite, Web Crypto
- Encryption
- AES-256-GCM, keys derived with PBKDF2 at 600,000 iterations
- Hosting
- Ready to use online, or self-hosted on your own server
- Started
- August 2026
What it does
Zero-knowledge storage
Notes, customer names and incident IDs are encrypted client-side. The server holds ciphertext and a hash of your login value.
Fast triage editor
A keyboard-driven editor that spots IPs, hashes, domains, UUIDs and CVEs as you type, with double-click to copy.
Seen before
Indicators from earlier triages are flagged when they appear again, with a jump to the earlier note.
IP reputation
Inline lookups with your own API key, bulk lookup with file upload, and an optional browser-extension bridge.
Stats
Verdict trends, the true and false positive split per tenant and type, and a triage-cadence heatmap.
Account security
Optional two-factor login, a one-time recovery key, a quick-unlock passcode and locking across tabs.
How it is built
The principles behind Triage Aid, and the choices that follow from them.
Encrypt before it leaves
Notes are encrypted in your browser before they are sent. The server only ever receives ciphertext it cannot read.
Two keys from one password
Your password produces two separate values: one unlocks your data, the other logs you in. Even a full copy of the database holds nothing readable.
Made for speed under pressure
The editor recognises IPs, hashes, domains and CVEs as you type, and remembers indicators you have seen before, so repeat offenders stand out.
Run it where you want
Use it online straight away, or run it on your own server as a single container.
What got better lately
1 improvement
- Triage AidA browser extension that runs IP reputation lookups from your own browser session