Hybrid Pro protection combining local browser/PWA security, explicit online-assisted analysis and a private server security core. Protect credentials, analyze phishing and suspicious links, scan user-selected files for antivirus and malware risk, work with granted folders, use File/Malware/Virus vaults and integrity baselines, audit web/privacy/network posture, and measure real browser/device performance — all inside one account-free cross-device PWA.
Run real browser/PWA measurements and local security checks, then use explicit online-assisted engines where deeper remote analysis is required. Omega Security Pro keeps browser boundaries precise: it does not pretend a PWA can silently inspect every application or replace native operating-system antivirus/EDR.
Omega Security Pro coordinates three distinct security layers: local-first Device/PWA protection, explicit Online-Assisted analysis, and a separate authenticated Private Omega Server Core. Every capability below follows the same function-colour family used by the current main navigation, 3D controls, live meters and specialist pages.
Live browser telemetry, credential tools, phishing heuristics, selected-file analysis, browser-granted folders, local File/Malware/Virus vaults, SHA-256 baselines, privacy diagnostics, settings, local history and real browser/device performance measurements.
Privacy-preserving breach lookups, public website/header checks, DNS and email-domain analysis, and explicit server-assisted selected-file analysis when connectivity and the configured remote capability are available.
Protected server administration for site-root integrity snapshots/backups, malware/virus-oriented web-code scans, private vaults, IP controls, .htaccess hardening, logs, runtime/site audits and administrator recovery actions.
Central session posture combining completed browser security, password, URL/phishing, selected-file and performance checks with separate live Hybrid Pro runtime meters. Untested modules remain untested instead of being assigned invented values.
Local password-strength analysis and cryptographic generation, optional k-anonymity breach checking, plus a separate AES-GCM encrypted credential vault whose PBKDF2-SHA256-derived key is created from the user's master password.
Local structural URL and message heuristics plus a real app-level outbound-link guard inside Omega. High-risk external links can be blocked within the PWA workflow; this is not a system-wide browser extension or OS web filter.
Files explicitly selected by the user can be SHA-256 hashed and checked for executable signatures, implemented local signatures such as the EICAR test pattern, and bounded risk indicators. Explicit Online Deep Scan uploads the selected sample to the Omega server endpoint; ClamAV results are included only when ClamAV is actually installed and executable on the host.
Bounded analysis of selected content for executable/script types, disguised extensions, encoded execution, command invocation, living-off-the-land patterns, obfuscation and high entropy. Results are indicators, not proof of absolute safety.
Explicit file selection plus browser-granted directory workflows where supported. Granted folders can be manually rescanned or periodically rescanned while the PWA remains open; unsupported browsers fall back to explicit file selection.
IndexedDB-backed application vaults store controlled copies/records with scan metadata. Restore Copy downloads a copy, Mark Safe moves a malware/virus item into the File Vault classification, and Delete removes the local vault item. The original operating-system file is not silently deleted.
The PWA stores explicit user-created SHA-256 baselines in IndexedDB and compares later selections with the latest stored baseline. The private server core is separate: it compares site-root files with its previous integrity snapshot, maintains content-addressed backups for eligible files and exposes authenticated restore/mark-safe/accept-removal actions.
The bounded server-side website audit checks public HTTP(S) destinations, follows up to five redirects, rejects private/reserved targets and evaluates HTTPS plus seven common response-security headers. The domain-security endpoint checks MX, SPF, DMARC and provider-defined DKIM selectors.
Measures the security/privacy capabilities actually exposed by the current browser: secure context, Web Crypto, service workers, WebAuthn/passkeys, privacy preference signals, selected permission states and Omega-origin storage information.
Tracks browser online/offline state, same-origin RTT and exposed connection hints. Local domain allow/block lists modify Omega's own URL risk decisions only; they do not alter the OS firewall, router or DNS.
Live timing and browser-exposed measurements include CPU micro-benchmark time, animation-frame interval, same-site RTT, logical processors, approximate device-memory hints where available, Omega-origin storage usage/quota and connection hints.
The implemented public breach workflow hashes the submitted password locally with SHA-1, sends only the first five hexadecimal characters to the Pwned Passwords range service, then compares returned suffixes locally. The full password and full hash are not sent by this check.
Local PWA preferences currently control the outbound-link phishing guard, permission for explicit online deep scanning, and the folder-watch interval. Settings are stored in the current browser profile.
The Hybrid runtime stores up to 500 recent local security events plus local counters for supported scans, classifications and blocked links. The main dashboard separately stores up to 50 locally generated reports that can be exported by the user.
The v4.0.3 service-worker shell precaches the complete public page set and core PWA assets. Navigation uses network-first with cached/offline fallback; API and private-core requests are deliberately excluded from service-worker interception. Online-only engines remain online-only.
The private PHP core uses dedicated administrator authentication, CSRF protection and a two-hour idle session timeout. It provides rolling site-root integrity snapshots/backups, batched malware/virus-oriented web-code scanning, File/Malware/Virus server vaults, IP controls, managed .htaccess hardening, logs and runtime/site/email/URL/message audit tools.
The public PWA does not require an account. Local vaults, baselines, settings, counters, history and reports belong to the current browser/PWA profile. User-initiated online functions transmit only what their specific operation requires.
Select a function, URL, message, password, file, folder or diagnostic.
Browser-safe checks execute locally first or alongside the selected workflow.
If remote information is required, Omega checks connection state and configured capability.
The real result returns to the relevant console, meter, report, vault, counter or local history record.
Omega Security Pro uses the strongest capabilities legitimately available to a website/PWA and its configured server engines, but it is not a kernel-level antivirus, native EDR agent, unrestricted whole-device scanner, operating-system firewall, VPN or packet interceptor. It cannot silently inspect every filesystem file, arbitrary process, unrestricted physical RAM, unrelated application data or all network traffic. Browser memory values can be approximate, Omega storage measurements refer to the web/PWA origin rather than unrestricted physical disk, and heuristic/remote results can contain false positives or false negatives.
The current architecture combines browser/PWA-local security, explicit online-assisted analysis and a separate authenticated private server core. Each card follows the same function-colour language used by the main menu, 3D controls, specialist pages and live consoles.
Central live posture view combining browser security, privacy, performance, connection state and completed protection results. Untested or unsupported measurements remain clearly identified.
Core SecurityLocal password analysis, cryptographic generation, optional privacy-preserving breach lookup and AES-GCM encrypted credential-vault workflows without requiring an account.
CredentialsURL structure and scam-message heuristics, app-level outbound-link interception, local domain rules and online website intelligence when connected.
Phishing & URLLocal selected-file antivirus-oriented checks plus explicit online deep scanning, server heuristics and ClamAV signatures when the host actually provides ClamAV.
AntivirusSHA-256, executable signatures, disguised extensions, encoded execution, command-invocation, obfuscation and high-entropy malware-risk indicators.
MalwareSelected-file scanning, browser-granted folders, manual granted-folder scans and live folder-watch rescans while the PWA remains open.
Files & FoldersSeparate IndexedDB-backed PWA quarantine categories with Restore Copy, Mark Safe and Delete actions, plus separate authenticated server vaults.
Threat VaultsCreate SHA-256 baselines and compare later selected files against the latest baseline to identify unchanged, modified and newly selected files.
IntegrityOnline HTTPS/security-header audits plus public SPF, DMARC and DKIM analysis through the included bounded server endpoints.
Web SecurityBrowser-visible secure-context, cryptographic, permissions and application-storage diagnostics without claiming unrestricted device surveillance.
PrivacyOnline/offline state, same-site RTT, browser network hints, app-level link protection and user-managed local domain allow/block lists.
NetworkReal CPU micro-benchmark, render interval, RTT, logical processors, browser-reported memory hint and Omega origin storage usage/quota.
PerformanceRemote analysis activates only when connected and explicitly requested. Offline actions remain visible but show the Internet Connection Required message.
Hybrid Online LayerLocal event history and counters record completed Omega telemetry, file scans, clean/threat classifications, vault actions and blocked links.
Local RecordsControl the PWA phishing guard, explicit online deep-scan preference and folder-watch interval for the current browser profile.
User ControlInstall across supported phones, tablets, laptops and desktops; cached local-capable tools remain available offline while online engines wait for reconnection.
PWA PlatformAuthenticated server integrity, malware/virus scanning, trusted backups, private vaults, IP controls, hardening, logs and administrator recovery actions.
Private CoreUse the public suite directly. Local data stays in the browser/PWA profile unless a function explicitly requires user-initiated online analysis.
Privacy by DesignLocal credential tools • encrypted credential vault • phishing/message and URL analysis • selected-file SHA-256, executable/signature and malware heuristics • explicit online-assisted file scans with ClamAV when available • granted-folder scans and live watch • File, Malware and Virus PWA vaults • browser/privacy audits • website and email-domain audits • integrity comparison • network/link defence • performance telemetry • protection settings • local reports and security history.
Kernel-level antivirus • unrestricted full-device malware scanning • silent inspection of every installed application • arbitrary access to private operating-system files or RAM • system-wide packet interception • reading private email accounts • accessing other apps' stored passwords • replacing the native operating-system firewall or EDR stack.
