docs: update portal for WRNexusJS 0.8.8
This commit is contained in:
@@ -7,7 +7,7 @@ page Security {
|
||||
view {
|
||||
<a href="#main" class="skip-link">Skip to content</a>
|
||||
<div class="docs-shell">
|
||||
<header class="topbar"><a class="brand" href="/"><span>W</span> WRNexusJS</a><nav aria-label="Primary"><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a></nav><div class="topbar-actions"><a class="preview-pill" href="/access">Preview · v0.8.7</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div></header>
|
||||
<header class="topbar"><a class="brand" href="/"><span>W</span> WRNexusJS</a><nav aria-label="Primary"><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a></nav><div class="topbar-actions"><a class="preview-pill" href="/access">Preview · v0.8.8</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div></header>
|
||||
<div class="mobile-doc-nav"><details><summary>Browse documentation</summary><nav><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a><a href="/tutorial">Tutorial</a><a href="/guides/project-structure">Guides</a><a href="/examples">Examples</a><a href="/search">Search</a></nav></details></div>
|
||||
<main id="main" class="portal-main docs-layout docs-layout--navigation"><aside class="docs-section-menu" aria-label="Documentation sections">
|
||||
<nav>
|
||||
@@ -31,8 +31,8 @@ export default {
|
||||
};</code></pre><h3 id="what-you-can-change">What you can change</h3><ul><li>Add only required API origins to CORS; never use a wildcard with credentialed requests.</li><li>Lower request limits for JSON APIs and define separate upload limits for accepted file types.</li><li>Extend CSP only for origins your application actually loads; avoid unsafe inline script exceptions.</li><li>Enable HSTS only after HTTPS works on every production hostname and subdomain you include.</li><li>Set session expiry, rotation, secure, HTTP-only, and SameSite behavior for your authentication flow.</li></ul><h2 id="verify-the-resolved-controls">Verify the resolved controls</h2><pre><code>bunx wrnexus config . --explain --profile=production
|
||||
bunx wrnexus security audit .
|
||||
bunx wrnexus typecheck .
|
||||
bunx wrnexus build .</code></pre><p>Review the resolved production configuration, then test a valid request, an invalid CSRF token, an oversized body, an unapproved origin, an anonymous protected request, and a permission-denied request. Security configuration is complete only when denial behavior is tested.</p><h2 id="supported-releases">Supported releases</h2><p>Only the current private-preview release 0.8.7 is documented here. A formal old-release support window is not yet published.</p><h2 id="report-a-vulnerability">Report a vulnerability</h2><p>Use WorkRoot’s approved private contact path at <a href="https://workroot.in/">workroot.in</a>. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.</p><h2 id="deployment-controls">Deployment controls</h2><p>Terminate TLS at a trusted edge, forward only expected proxy headers, store secrets outside source control, apply database migrations before traffic, and monitor rejected requests without logging credentials. Continue with the complete <a href="/guides/security">application security guide</a>.</p></article></div><aside class="on-this-page"><h2>On this page</h2><nav><a class="toc-level-2" href="#start-with-a-production-policy">Start with a production policy</a><a class="toc-level-3" href="#what-you-can-change">What you can change</a><a class="toc-level-2" href="#verify-the-resolved-controls">Verify the resolved controls</a><a class="toc-level-2" href="#supported-releases">Supported releases</a><a class="toc-level-2" href="#report-a-vulnerability">Report a vulnerability</a><a class="toc-level-2" href="#deployment-controls">Deployment controls</a></nav></aside></main>
|
||||
<footer><div class="footer-brand"><span class="footer-mark" aria-hidden="true">W</span><p><strong>WRNexusJS 0.8.7</strong><span>Server-first documentation for the Bun-native framework.</span></p></div><nav aria-label="Footer"><a href="/access">Request access</a><a href="/license">License</a><a href="/security">Security</a><a href="/support">Support</a><a href="/llms.txt">AI guide</a></nav><p class="footer-meta">Created by <a href="https://workroot.in/">WorkRoot</a> · Private Developer Preview</p></footer>
|
||||
bunx wrnexus build .</code></pre><p>Review the resolved production configuration, then test a valid request, an invalid CSRF token, an oversized body, an unapproved origin, an anonymous protected request, and a permission-denied request. Security configuration is complete only when denial behavior is tested.</p><h2 id="supported-releases">Supported releases</h2><p>Only the current private-preview release 0.8.8 is documented here. A formal old-release support window is not yet published.</p><h2 id="report-a-vulnerability">Report a vulnerability</h2><p>Use WorkRoot’s approved private contact path at <a href="https://workroot.in/">workroot.in</a>. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.</p><h2 id="deployment-controls">Deployment controls</h2><p>Terminate TLS at a trusted edge, forward only expected proxy headers, store secrets outside source control, apply database migrations before traffic, and monitor rejected requests without logging credentials. Continue with the complete <a href="/guides/security">application security guide</a>.</p></article></div><aside class="on-this-page"><h2>On this page</h2><nav><a class="toc-level-2" href="#start-with-a-production-policy">Start with a production policy</a><a class="toc-level-3" href="#what-you-can-change">What you can change</a><a class="toc-level-2" href="#verify-the-resolved-controls">Verify the resolved controls</a><a class="toc-level-2" href="#supported-releases">Supported releases</a><a class="toc-level-2" href="#report-a-vulnerability">Report a vulnerability</a><a class="toc-level-2" href="#deployment-controls">Deployment controls</a></nav></aside></main>
|
||||
<footer><div class="footer-brand"><span class="footer-mark" aria-hidden="true">W</span><p><strong>WRNexusJS 0.8.8</strong><span>Server-first documentation for the Bun-native framework.</span></p></div><nav aria-label="Footer"><a href="/access">Request access</a><a href="/license">License</a><a href="/security">Security</a><a href="/support">Support</a><a href="/llms.txt">AI guide</a></nav><p class="footer-meta">Created by <a href="https://workroot.in/">WorkRoot</a> · Private Developer Preview</p></footer>
|
||||
</div>
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user