Security
19 packages, each available for 11 model families.
audit-log
Recording security-relevant events so a breach is detectable — what to log, what never to log, and making the record tamper-evident.
authentication
Password storage, session handling and login-flow rules for building authentication that survives a credential-stuffing campaign and a database leak.
authorization
Deciding what an authenticated user may do — enforcing at the data layer, preventing IDOR, and modelling roles without permission sprawl.
command-injection
Executing external programs without letting input become part of the command — argument arrays, why shells are the problem, and safe temporary files.
cors
Configuring cross-origin resource sharing without opening your API — explicit origins, why reflection is dangerous, and what CORS does not protect.
csrf
Preventing cross-site request forgery with SameSite cookies, synchroniser tokens, and Origin validation — and knowing which one is actually…
encryption
Encrypting data correctly — authenticated ciphers, nonce discipline, key management, and the primitives that must never be used.
headers
HTTP security headers that actually matter — CSP, HSTS, frame protection, and the deprecated ones still being copied from old blog posts.
https
TLS configuration that holds up — protocol and cipher selection, certificate automation, HSTS, and terminating TLS without losing it internally.
jwt
Issuing and validating JSON Web Tokens safely — algorithm pinning, claim validation, key rotation, and why revocation is the hard part.
oauth
Implementing OAuth 2.1 and OIDC correctly — authorization code with PKCE, redirect URI exactness, state, and the flows that are now forbidden.
owasp
The OWASP Top 10 as an engineering checklist — each category named, what it looks like in code, and the control that actually prevents it.
passwords
Password policy that reduces account takeover — length over composition, breach screening, and the rules that actively make things worse.
path-traversal
Confining file access to an intended directory — resolve-then-verify, symlink and archive pitfalls, and why blocking "../" does not work.
rate-limiting
Limiting request rates without breaking legitimate users — algorithm choice, correct keys, distributed state, and the headers clients need.
secret-management
Keeping credentials out of source, configuration and images — storage, injection, rotation, and what to do once a secret has leaked.
security-review
Reviewing a change for security — the diff patterns that matter, questions that find real bugs, and what to automate instead of eyeballing.
sql-injection
Preventing SQL injection with parameterised queries, safe dynamic SQL, and the escaping rules that do not work.
xss
Preventing cross-site scripting through contextual output encoding, a strict Content-Security-Policy, and safe DOM and framework APIs.