Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them through GitHub Security Advisories.

You will receive an acknowledgment within 48 hours from @rennf93.

When reporting, please include:

• Type of vulnerability
• Full paths of source file(s) related to the vulnerability
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

When deploying applications using @guardcore packages:

• API tokens: Store all tokens (IPInfo, Redis, etc.) in environment variables, never in source code
• IP whitelisting: Use whitelistedIPs to restrict access to known IPs for admin endpoints
• Rate limiting: Always enable rate limiting in production with appropriate thresholds
• HTTPS enforcement: Enable enforceHttps in production environments
• CORS configuration: Restrict allowed origins, methods, and headers to the minimum required
• Redis security: Use TLS connections, authentication, and network isolation for Redis instances
• Security headers: Use the default security headers or configure stricter values
• Request size limits: Set appropriate maxRequestSize and contentType restrictions
• Cloud provider blocking: Enable cloud provider IP blocking if your API should not be accessed from cloud infrastructure

@guardcore provides the following security features:

• IP-based access control (whitelist/blacklist)
• Rate limiting (per-IP, per-endpoint, with Redis-backed distributed state)
• Suspicious pattern detection (SQL injection, XSS, path traversal, command injection, etc.)
• Cloud provider IP blocking (AWS, GCP, Azure, Oracle, DigitalOcean)
• GeoIP-based filtering
• HTTPS enforcement and redirection
• Security header injection (HSTS, CSP, X-Frame-Options, etc.)
• Request size and content-type validation
• User-agent filtering
• Referrer validation
• Authentication header enforcement
• Time-window-based access control
• Custom validator support
• Behavioral rule processing

@guardcore is designed to mitigate the following threats at the application middleware layer:

We follow a responsible disclosure process:

1. Reporter submits vulnerability via GitHub Security Advisory
2. Maintainer acknowledges within 48 hours
3. Maintainer investigates and develops a fix
4. Fix is reviewed and tested
5. Security advisory is published with the fix release
6. Reporter is credited (unless they prefer anonymity)

We kindly ask that you:

• Allow reasonable time for the vulnerability to be fixed before public disclosure
• Make a good faith effort to avoid privacy violations, data destruction, or service disruption
• Do not exploit the vulnerability beyond what is necessary to demonstrate it