Repository navigation

Security

docs/SECURITY.md

Security Model

Security Controls

HTTP hardening via helmet
request throttling via express-rate-limit
strict Zod input validation
API key auth support for protected endpoints
CORS allowlist via ALLOWED_ORIGIN
secret scanning via npm run security:check

Sensitive Data Policy

never commit real API keys, tokens, passwords, or DSNs
keep runtime secrets in environment variables
use .env.example placeholders only

Operator Checklist

set strong BUILDERBOT_API_KEY
restrict ALLOWED_ORIGIN in production
run behind TLS/reverse proxy
run npm run security:check before pushes
rotate credentials periodically

Security Positioning

Security posture is a first-class product feature for enterprise-grade deterministic planning APIs.

There aren't any published security advisories