{"schemaVersion":2,"usageGuideUrl":"https://securitycards.rewarelabs.com/agent-usage.md","catalogUrl":"https://securitycards.rewarelabs.com/llms.txt","jsonCatalogUrl":"https://securitycards.rewarelabs.com/catalog.json","languages":[{"slug":"csharp","label":"C#","catalogUrl":"https://securitycards.rewarelabs.com/llms/csharp.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/csharp.md","libraries":[{"slug":"asp-net","name":"Asp Net","latestVersion":"v10-0-10","versions":[{"version":"v10.0.10","versionSlug":"v10-0-10","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/csharp/asp-net/v10-0-10/","path":"/libraries/csharp/asp-net/v10-0-10/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10.md","bundlePath":"/downloads/csharp/asp-net/v10-0-10.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/0_security_blueprint.md","blueprintPath":"/downloads/csharp/asp-net/v10-0-10/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When designing or configuring application-wide authorization defaults to ensure unannotated endpoints and default policy checks enforce secure access control standards.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/access-control.md","path":"/downloads/csharp/asp-net/v10-0-10/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring cookie authentication options and session lifetimes in ASP.NET Core applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/api-contract-misuse.md","path":"/downloads/csharp/asp-net/v10-0-10/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Setting up inbound JWT bearer authentication, OpenID Connect flows, or WS-Federation token handlers that require cryptographic verification of signatures, issuers, and audiences.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/authentication.md","path":"/downloads/csharp/asp-net/v10-0-10/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Developing single-page applications or Blazor components that handle client-side deep links, navigation targets, and unmapped route parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/boundary-control.md","path":"/downloads/csharp/asp-net/v10-0-10/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Binding authentication, WS-Federation, JWT bearer token validation options, or Kestrel configurations from external or file-based configuration providers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/configuration-source-integrity.md","path":"/downloads/csharp/asp-net/v10-0-10/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring cryptographic algorithms, encryption mechanisms, and exception handling for data protection and payload encryption.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/cryptography.md","path":"/downloads/csharp/asp-net/v10-0-10/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring authentication handlers, remote identity providers, or processing state-changing form submissions in ASP.NET Core applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/csrf.md","path":"/downloads/csharp/asp-net/v10-0-10/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"Configuring state parameter serialization and deserialization in `OpenIdConnectHandler` for callback requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/deserialization.md","path":"/downloads/csharp/asp-net/v10-0-10/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Exporting and persisting HTTPS certificates or private key files onto disk storage.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/file-handling.md","path":"/downloads/csharp/asp-net/v10-0-10/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Use when binding user requests to controllers or minimal APIs, updating models via `TryUpdateModelAsync`, or validating hierarchical and complex model properties.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/input-contract-definition.md","path":"/downloads/csharp/asp-net/v10-0-10/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When performing user or role lookups within ASP.NET Core Identity to ensure string representations are consistently normalized.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/input-interpretation-safety.md","path":"/downloads/csharp/asp-net/v10-0-10/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring JWT bearer authentication events to extract access tokens from query string parameters for specific network protocols like WebSockets or Server-Sent Events.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/interface-protocol-hardening.md","path":"/downloads/csharp/asp-net/v10-0-10/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring WS-Federation authentication options in production environments to retrieve signing keys and metadata securely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/network-boundary.md","path":"/downloads/csharp/asp-net/v10-0-10/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When writing untrusted data or request query parameters directly into HTTP HTML response bodies in custom middleware or endpoint handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/output-encoding.md","path":"/downloads/csharp/asp-net/v10-0-10/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring connection handlers and buffer thresholds in ASP.NET applications to enforce backpressure against slow or malicious clients.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/resource-exhaustion.md","path":"/downloads/csharp/asp-net/v10-0-10/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring custom error handlers or authentication event hooks where raw exception details might otherwise be exposed to callers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/runtime-environment-hardening.md","path":"/downloads/csharp/asp-net/v10-0-10/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Handling temporary key derivation buffers, XML secret arrays, temporary certificate files, and authentication tokens in ASP.NET Core.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/secret-handling.md","path":"/downloads/csharp/asp-net/v10-0-10/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When managing user authentication tickets, session validation, principal refreshing, or updating identity features during request processing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/security-control-integrity.md","path":"/downloads/csharp/asp-net/v10-0-10/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When configuring authentication cookies, cookie security policies, and server-side ticket storage for sessions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/csharp/asp-net/v10-0-10/session-management.md","path":"/downloads/csharp/asp-net/v10-0-10/session-management.md"}]}]}]},{"slug":"cpp","label":"C++","catalogUrl":"https://securitycards.rewarelabs.com/llms/cpp.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/cpp.md","libraries":[{"slug":"envoy","name":"Envoy","latestVersion":"v1-39-0","versions":[{"version":"v1.39.0","versionSlug":"v1-39-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/cpp/envoy/v1-39-0/","path":"/libraries/cpp/envoy/v1-39-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0.md","bundlePath":"/downloads/cpp/envoy/v1-39-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/0_security_blueprint.md","blueprintPath":"/downloads/cpp/envoy/v1-39-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring route-level or virtual host-level CORS policies in Envoy to manage cross-origin access and protect backend resources from unauthorized third-party requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/access-control.md","path":"/downloads/cpp/envoy/v1-39-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring the OAuth2 HTTP filter in Envoy where multiple request header manipulation flags could be mistakenly enabled simultaneously.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/api-contract-misuse.md","path":"/downloads/cpp/envoy/v1-39-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Setting up Envoy OAuth2 authentication filters and client credentials for token exchange.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/authentication.md","path":"/downloads/cpp/envoy/v1-39-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When loading dynamic modules into Envoy that run in-process and share its full privilege level and memory space.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/boundary-control.md","path":"/downloads/cpp/envoy/v1-39-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring dynamic module TLS certificate validators or shared library paths where configuration source integrity must be maintained.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/configuration-source-integrity.md","path":"/downloads/cpp/envoy/v1-39-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"When configuring cryptographic operations, token encryption in filters, and signature verification routines.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/cryptography.md","path":"/downloads/cpp/envoy/v1-39-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring OAuth2 authentication filters and cookies in Envoy to protect against cross-site request forgery and authorization state fixation attacks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/csrf.md","path":"/downloads/cpp/envoy/v1-39-0/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"When processing dynamic xDS configurations or local protobuf structures to prevent accepting unvalidated or smuggled fields.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/deserialization.md","path":"/downloads/cpp/envoy/v1-39-0/deserialization.md"},{"slug":"injection","title":"Injection","description":"When constructing query strings for AWS STS AssumeRole requests from user-configurable parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/injection.md","path":"/downloads/cpp/envoy/v1-39-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Developing or modifying custom HTTP filters placed prior to the Envoy router filter.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/input-contract-definition.md","path":"/downloads/cpp/envoy/v1-39-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When configuring host matching, authority validation, or TLS SNI parameters for untrusted network endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/input-interpretation-safety.md","path":"/downloads/cpp/envoy/v1-39-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring downstream messaging filters and upstream routing rules for Kafka broker and mesh proxies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/interface-protocol-hardening.md","path":"/downloads/cpp/envoy/v1-39-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring Envoy HTTP route internal redirect policies where upstream services may trigger internal redirects.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/network-boundary.md","path":"/downloads/cpp/envoy/v1-39-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring Envoy routes, virtual hosts, and upstream clusters to handle network retries, timeouts, and request hedging safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/resource-exhaustion.md","path":"/downloads/cpp/envoy/v1-39-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Building and compiling Envoy for production deployment where security policy guarantees and security vulnerability response processes are required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/runtime-environment-hardening.md","path":"/downloads/cpp/envoy/v1-39-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Use when configuring automated TLS certificate, validation context, and session ticket key lifecycles using dynamic Secret Discovery Service (SDS) providers or filesystem-backed watched directories in…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/secret-handling.md","path":"/downloads/cpp/envoy/v1-39-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring Envoy security filters, authorization hooks, and authentication mechanisms where failing open or bypassing checks could compromise security control integrity.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/envoy/v1-39-0/security-control-integrity.md","path":"/downloads/cpp/envoy/v1-39-0/security-control-integrity.md"}]}]},{"slug":"protobuf","name":"Protobuf","latestVersion":"v35-1","versions":[{"version":"v35.1","versionSlug":"v35-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/cpp/protobuf/v35-1/","path":"/libraries/cpp/protobuf/v35-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1.md","bundlePath":"/downloads/cpp/protobuf/v35-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/0_security_blueprint.md","blueprintPath":"/downloads/cpp/protobuf/v35-1/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Constructing message components, managing byte buffers, and populating repeated or map fields.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/api-contract-misuse.md","path":"/downloads/cpp/protobuf/v35-1/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Parsing or converting messages containing `google.protobuf.Any` types using text format functions in Python.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/boundary-control.md","path":"/downloads/cpp/protobuf/v35-1/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring protocol buffer code generators in automated or multi-tenant build environments that read options from environment variables.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/configuration-source-integrity.md","path":"/downloads/cpp/protobuf/v35-1/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Serializing Protobuf messages and computing integrity verification, checksums, or signatures over the payload.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/cryptography.md","path":"/downloads/cpp/protobuf/v35-1/cryptography.md"},{"slug":"deserialization","title":"Deserialization","description":"Deserializing Protocol Buffer messages containing `google.protobuf.Any` fields or custom extension fields from untrusted inputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/deserialization.md","path":"/downloads/cpp/protobuf/v35-1/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"When configuring `CommandLineInterface` or `DiskSourceTree` to compile protocol buffer files and manage output or import paths.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/file-handling.md","path":"/downloads/cpp/protobuf/v35-1/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Parsing text format strings or constructing protocol buffer messages from external input where required fields and valid contracts must be enforced.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/input-contract-definition.md","path":"/downloads/cpp/protobuf/v35-1/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing, validating, and managing protocol buffer messages containing unknown fields across different language runtimes and parsers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/input-interpretation-safety.md","path":"/downloads/cpp/protobuf/v35-1/input-interpretation-safety.md"},{"slug":"memory-safety","title":"Memory Safety","description":"Developing multi-threaded Protobuf applications that utilize custom arena block allocators or coordinate arena destruction and resets across multiple threads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/memory-safety.md","path":"/downloads/cpp/protobuf/v35-1/memory-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering serialized Protocol Buffer text format output or handling external display contexts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/output-encoding.md","path":"/downloads/cpp/protobuf/v35-1/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Parsing, deserializing, or processing untrusted binary, JSON, text format, or descriptor payloads across various Protocol Buffers language runtimes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/resource-exhaustion.md","path":"/downloads/cpp/protobuf/v35-1/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Logging, printing, or stringifying protobuf messages that contain sensitive credentials, tokens, or personal data.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/secret-handling.md","path":"/downloads/cpp/protobuf/v35-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Compiling protocol buffer definitions and launching applications that consume generated message code to ensure that obsolete legacy gencode fails securely on startup.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/cpp/protobuf/v35-1/security-control-integrity.md","path":"/downloads/cpp/protobuf/v35-1/security-control-integrity.md"}]}]}]},{"slug":"dart","label":"Dart","catalogUrl":"https://securitycards.rewarelabs.com/llms/dart.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/dart.md","libraries":[{"slug":"flutter","name":"Flutter","latestVersion":"3-44-8","versions":[{"version":"3.44.8","versionSlug":"3-44-8","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/dart/flutter/3-44-8/","path":"/libraries/dart/flutter/3-44-8/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8.md","bundlePath":"/downloads/dart/flutter/3-44-8.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/0_security_blueprint.md","blueprintPath":"/downloads/dart/flutter/3-44-8/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When building forms in Flutter and processing user inputs prior to saving or submission.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/api-contract-misuse.md","path":"/downloads/dart/flutter/3-44-8/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Performing mDNS VM Service discovery on local networks where multiple active processes or services are present.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/boundary-control.md","path":"/downloads/dart/flutter/3-44-8/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring custom repository mirrors, SDK download locations, or storage endpoints for Flutter and Dart packages.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/configuration-source-integrity.md","path":"/downloads/dart/flutter/3-44-8/configuration-source-integrity.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Configuring or testing rendering validation error handlers and error suppression mechanisms in low-level graphics subsystems.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/escape-hatch.md","path":"/downloads/dart/flutter/3-44-8/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"When creating temporary or sensitive files on disk to prevent overwriting pre-existing files or following malicious symlinks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/file-handling.md","path":"/downloads/dart/flutter/3-44-8/file-handling.md"},{"slug":"injection","title":"Injection","description":"Developing or building Flutter applications, handling custom web-define configurations, rendering templates, or utilizing dynamic expression evaluation and compilation APIs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/injection.md","path":"/downloads/dart/flutter/3-44-8/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Configuring Android build settings and supplying build numbers in Flutter tooling.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/input-contract-definition.md","path":"/downloads/dart/flutter/3-44-8/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Routing and rewriting web requests to upstream backend servers using proxy rules.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/input-driven-boundary-selection.md","path":"/downloads/dart/flutter/3-44-8/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When parsing untrusted representations, configuration files, localization messages, or command-line option inputs in Flutter applications and tooling.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/input-interpretation-safety.md","path":"/downloads/dart/flutter/3-44-8/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Registering native Ffi native resolvers and managing binary native payloads between Dart isolates and host platforms.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/interface-protocol-hardening.md","path":"/downloads/dart/flutter/3-44-8/interface-protocol-hardening.md"},{"slug":"memory-safety","title":"Memory Safety","description":"Compiling and testing unoptimized Flutter Engine debug builds to catch native memory safety flaws such as buffer overflows and use-after-free.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/memory-safety.md","path":"/downloads/dart/flutter/3-44-8/memory-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When configuring HTTP proxy environment variables for Flutter CLI workflows and development tools to ensure local loopback traffic bypasses the external proxy.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/network-boundary.md","path":"/downloads/dart/flutter/3-44-8/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Decoding large or user-supplied image assets into memory where unbounded bitmap allocations can cause out-of-memory crashes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/resource-exhaustion.md","path":"/downloads/dart/flutter/3-44-8/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When building logging mechanisms, handling subprocess execution outputs, or generating system diagnostic reports that might contain sensitive credentials or PII.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/dart/flutter/3-44-8/secret-handling.md","path":"/downloads/dart/flutter/3-44-8/secret-handling.md"}]}]}]},{"slug":"elixir","label":"Elixir","catalogUrl":"https://securitycards.rewarelabs.com/llms/elixir.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/elixir.md","libraries":[{"slug":"phoenix","name":"Phoenix","latestVersion":"v1-8-9","versions":[{"version":"v1.8.9","versionSlug":"v1-8-9","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/elixir/phoenix/v1-8-9/","path":"/libraries/elixir/phoenix/v1-8-9/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9.md","bundlePath":"/downloads/elixir/phoenix/v1-8-9.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/0_security_blueprint.md","blueprintPath":"/downloads/elixir/phoenix/v1-8-9/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Developing data layer context functions, controllers, or channel callbacks where database queries and resource actions must be restricted to the authenticated user or tenant.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/access-control.md","path":"/downloads/elixir/phoenix/v1-8-9/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When testing Phoenix controllers to ensure domain-level exceptions and resource lookup failures map correctly to expected HTTP status codes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/api-contract-misuse.md","path":"/downloads/elixir/phoenix/v1-8-9/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing user authentication, token-based verification, magic links, API bearer token validation, and secure socket connection options in Phoenix.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/authentication.md","path":"/downloads/elixir/phoenix/v1-8-9/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Handling user-supplied return paths or redirect targets in Phoenix controllers to prevent open redirect vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/boundary-control.md","path":"/downloads/elixir/phoenix/v1-8-9/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"When generating authentication features or configuring password hashing for user credentials.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/cryptography.md","path":"/downloads/elixir/phoenix/v1-8-9/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring browser pipelines, session handling, and root layouts in Phoenix applications to prevent cross-site request forgery.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/csrf.md","path":"/downloads/elixir/phoenix/v1-8-9/csrf.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Handling dynamic input that should be evaluated as code or passed to system execution functions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/dangerous-execution.md","path":"/downloads/elixir/phoenix/v1-8-9/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"Deserializing binary data from untrusted sources in Phoenix or Plug applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/deserialization.md","path":"/downloads/elixir/phoenix/v1-8-9/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"When handling user file uploads using `Plug.Upload` and persisting or serving files.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/file-handling.md","path":"/downloads/elixir/phoenix/v1-8-9/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building dynamic queries and database fragments in applications using Ecto or raw SQL queries","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/injection.md","path":"/downloads/elixir/phoenix/v1-8-9/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When handling external user input maps, form submissions, or API parameters in Ecto changesets before application processing and database operations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/input-contract-definition.md","path":"/downloads/elixir/phoenix/v1-8-9/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Handling incoming request parameters in Phoenix controllers where distinct sources such as query parameters, path variables, and request bodies must be unambiguously separated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/input-interpretation-safety.md","path":"/downloads/elixir/phoenix/v1-8-9/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring router pipelines and endpoint transport settings to enforce browser security headers and strict transport security.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/interface-protocol-hardening.md","path":"/downloads/elixir/phoenix/v1-8-9/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring local development endpoint server listeners and network interface bindings in Phoenix applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/network-boundary.md","path":"/downloads/elixir/phoenix/v1-8-9/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering dynamic HTML responses and user input in Phoenix views and templates.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/output-encoding.md","path":"/downloads/elixir/phoenix/v1-8-9/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring Phoenix sockets, transports, and endpoint parsers to handle incoming client connections and payloads safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/resource-exhaustion.md","path":"/downloads/elixir/phoenix/v1-8-9/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring runtime environments, endpoints, and database connections for production deployments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/runtime-environment-hardening.md","path":"/downloads/elixir/phoenix/v1-8-9/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When processing or logging request parameters, custom data maps, or schema fields containing sensitive credentials and tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/secret-handling.md","path":"/downloads/elixir/phoenix/v1-8-9/secret-handling.md"},{"slug":"session-management","title":"Session Management","description":"Implementing user logout flows in Phoenix web applications to ensure session state is completely invalidated and active WebSocket connections are terminated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/elixir/phoenix/v1-8-9/session-management.md","path":"/downloads/elixir/phoenix/v1-8-9/session-management.md"}]}]}]},{"slug":"go","label":"Go","catalogUrl":"https://securitycards.rewarelabs.com/llms/go.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go.md","libraries":[{"slug":"beego","name":"Beego","latestVersion":"v2-3-10","versions":[{"version":"v2.3.10","versionSlug":"v2-3-10","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/beego/v2-3-10/","path":"/libraries/go/beego/v2-3-10/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10.md","bundlePath":"/downloads/go/beego/v2-3-10.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/0_security_blueprint.md","blueprintPath":"/downloads/go/beego/v2-3-10/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring Cross-Origin Resource Sharing (`CORS`) filters for web applications or API routes using `beego`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/access-control.md","path":"/downloads/go/beego/v2-3-10/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When building database queries and propagating request contexts in Beego ORM.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/api-contract-misuse.md","path":"/downloads/go/beego/v2-3-10/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When validating incoming API requests using shared secrets and timestamps to verify client identity and prevent unauthorized requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/authentication.md","path":"/downloads/go/beego/v2-3-10/authentication.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Loading YAML or JSON configuration files into Beego applications where environment variable interpolation is evaluated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/configuration-source-integrity.md","path":"/downloads/go/beego/v2-3-10/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring or encoding session cookies and implementing cryptographic key management within Beego applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/cryptography.md","path":"/downloads/go/beego/v2-3-10/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"When developing state-changing web endpoints using Beego controllers and handlers that require Cross-Site Request Forgery protection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/csrf.md","path":"/downloads/go/beego/v2-3-10/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"When storing and retrieving custom struct types in Beego session providers that utilize `gob` encoding and decoding.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/deserialization.md","path":"/downloads/go/beego/v2-3-10/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"When handling user input or uploaded filenames in controller operations, file downloads, or file attachments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/file-handling.md","path":"/downloads/go/beego/v2-3-10/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building database queries, raw SQL statements, or query builder expressions using Beego ORM.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/injection.md","path":"/downloads/go/beego/v2-3-10/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When validating untrusted incoming request data and struct objects against strict type, range, and format rules before processing them in application logic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/input-contract-definition.md","path":"/downloads/go/beego/v2-3-10/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Extracting and utilizing route parameters, query strings, or request payloads in Beego applications where automated decoding or interpretation boundaries apply.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/input-interpretation-safety.md","path":"/downloads/go/beego/v2-3-10/input-interpretation-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When configuring HTTP settings or serializing JSON payloads via `httplib` that may be rendered in web interfaces or HTML templates.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/output-encoding.md","path":"/downloads/go/beego/v2-3-10/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring web application server parameters or handling incoming request payloads in Beego to protect against memory exhaustion and denial-of-service vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/resource-exhaustion.md","path":"/downloads/go/beego/v2-3-10/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Deploying the Beego application to production environments where sensitive internals, error traces, and SQL debugging output must be hidden from end-users.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/runtime-environment-hardening.md","path":"/downloads/go/beego/v2-3-10/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring database connection strings, session providers, cache stores, logging targets, or configuration files that require sensitive credentials and authentication secrets.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/secret-handling.md","path":"/downloads/go/beego/v2-3-10/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Registering access control, authentication, or input validation filters via `InsertFilter` where writing an error status code or response body must immediately halt downstream request processing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/security-control-integrity.md","path":"/downloads/go/beego/v2-3-10/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session providers and cookie security attributes for web applications and API endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/session-management.md","path":"/downloads/go/beego/v2-3-10/session-management.md"}]}]},{"slug":"caddy","name":"Caddy","latestVersion":"v2-11-4","versions":[{"version":"v2.11.4","versionSlug":"v2-11-4","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/caddy/v2-11-4/","path":"/libraries/go/caddy/v2-11-4/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4.md","bundlePath":"/downloads/go/caddy/v2-11-4.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/0_security_blueprint.md","blueprintPath":"/downloads/go/caddy/v2-11-4/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When defining server listeners, routing policies, forwarding authentication headers, and administrative API access boundaries to enforce authorization constraints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/access-control.md","path":"/downloads/go/caddy/v2-11-4/access-control.md"},{"slug":"authentication","title":"Authentication","description":"When implementing or configuring user credential authentication and password verification mechanisms in Caddy HTTP authentication providers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/authentication.md","path":"/downloads/go/caddy/v2-11-4/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Configuring Caddy behind upstream load balancers, reverse proxies, or when accepting PROXY protocol connections from external sources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/boundary-control.md","path":"/downloads/go/caddy/v2-11-4/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When loading dynamic Caddy configurations or root CA certificates over the network using remote endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/configuration-source-integrity.md","path":"/downloads/go/caddy/v2-11-4/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring TLS server protocols, minimum version thresholds, cipher suites, curves, and cryptographic parameters in Caddy.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/cryptography.md","path":"/downloads/go/caddy/v2-11-4/cryptography.md"},{"slug":"file-handling","title":"File Handling","description":"When mapping untrusted HTTP request paths, FastCGI configurations, or template file operations to local filesystem paths.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/file-handling.md","path":"/downloads/go/caddy/v2-11-4/file-handling.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Configuring FastCGI script execution boundaries and split paths where untrusted input or Unicode characters could lead to boundary confusion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/input-driven-boundary-selection.md","path":"/downloads/go/caddy/v2-11-4/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When configuring HTTP path matchers, routing rules, or decoding certificate PEM structures in Caddy to ensure unambiguous input interpretation and prevent security bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/input-interpretation-safety.md","path":"/downloads/go/caddy/v2-11-4/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"When configuring reverse proxy transport layers and proxy protocol parameters to communicate with upstream servers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/interface-protocol-hardening.md","path":"/downloads/go/caddy/v2-11-4/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring network interfaces, proxy binding, and trusted client IP ranges across trust boundaries in Caddy.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/network-boundary.md","path":"/downloads/go/caddy/v2-11-4/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When constructing dynamic Caddy configurations, headers, redirect targets, or rendering untrusted user input within Caddy template responses and markdown files.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/output-encoding.md","path":"/downloads/go/caddy/v2-11-4/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Use when configuring Caddy servers, reverse proxies, and file servers to handle incoming client traffic and backend payloads securely without exhausting memory resources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/resource-exhaustion.md","path":"/downloads/go/caddy/v2-11-4/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Deploying Caddy as a system service or container manifest in production environments to ensure runtime storage resolves to secure absolute paths instead of falling back to working directories.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/runtime-environment-hardening.md","path":"/downloads/go/caddy/v2-11-4/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring issuers, certificates, and sensitive keys in Caddyfile or JSON configurations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/secret-handling.md","path":"/downloads/go/caddy/v2-11-4/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring Caddyfile directives where security controls like authentication or header validation depend on strict execution sequence relative to request rewrites or proxy handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/caddy/v2-11-4/security-control-integrity.md","path":"/downloads/go/caddy/v2-11-4/security-control-integrity.md"}]}]},{"slug":"chi","name":"Chi","latestVersion":"v5-3-1","versions":[{"version":"v5.3.1","versionSlug":"v5-3-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/chi/v5-3-1/","path":"/libraries/go/chi/v5-3-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1.md","bundlePath":"/downloads/go/chi/v5-3-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/0_security_blueprint.md","blueprintPath":"/downloads/go/chi/v5-3-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When organizing routes in Chi and securing endpoints against unauthorized actions or cross-user access","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/access-control.md","path":"/downloads/go/chi/v5-3-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Integrating Chi routers, middleware components, and custom HTTP method handlers into a Go application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/api-contract-misuse.md","path":"/downloads/go/chi/v5-3-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Developing authentication middleware to verify user identity before storing session or user state in the request context.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/authentication.md","path":"/downloads/go/chi/v5-3-1/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Setting up boundary trust verification and client IP retrieval using middleware.ClientIPFromHeader in chi applications behind a reverse proxy.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/boundary-control.md","path":"/downloads/go/chi/v5-3-1/boundary-control.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When routing middleware execution using `middleware.RouteHeaders()` to apply security checks or access controls based on untrusted request headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/input-driven-boundary-selection.md","path":"/downloads/go/chi/v5-3-1/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When building HTTP routers and handling URL parameters, path extensions, or request path normalization in Chi","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/input-interpretation-safety.md","path":"/downloads/go/chi/v5-3-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"When registering endpoints and configuring routers to ensure requests strictly adhere to expected HTTP methods and protocol semantics.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/interface-protocol-hardening.md","path":"/downloads/go/chi/v5-3-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Setting up HTTP routers behind reverse proxies or load balancers where client IP addresses must be securely resolved without falling back to vulnerable default header parsing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/network-boundary.md","path":"/downloads/go/chi/v5-3-1/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When building endpoints or route groups that accept client payloads or execute resource-intensive operations and require protection against resource exhaustion and Denial of Service.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/resource-exhaustion.md","path":"/downloads/go/chi/v5-3-1/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When building HTTP endpoints and configuring logging middleware with chi to prevent plaintext exposure of secrets in request URIs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/secret-handling.md","path":"/downloads/go/chi/v5-3-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When registering global middleware, constructing middleware chains, or setting up routing middleware in Chi applications to ensure security mechanisms execute reliably.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/security-control-integrity.md","path":"/downloads/go/chi/v5-3-1/security-control-integrity.md"}]}]},{"slug":"cobra","name":"Cobra","latestVersion":"v1-10-2","versions":[{"version":"v1.10.2","versionSlug":"v1-10-2","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/cobra/v1-10-2/","path":"/libraries/go/cobra/v1-10-2/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2.md","bundlePath":"/downloads/go/cobra/v1-10-2.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/0_security_blueprint.md","blueprintPath":"/downloads/go/cobra/v1-10-2/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing Cobra command execution handlers that rely on flag group validation rules.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/api-contract-misuse.md","path":"/downloads/go/cobra/v1-10-2/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When defining parameters that should apply exclusively to a single root or subcommand, preventing unauthorized child commands from inheriting sensitive options.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/boundary-control.md","path":"/downloads/go/cobra/v1-10-2/boundary-control.md"},{"slug":"file-handling","title":"File Handling","description":"Generating shell completion scripts using Cobra file generation functions like `GenBashCompletionFileV2`, `GenPowerShellCompletionFile`, or `GenFishCompletionFile` where destination paths might be inf…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/file-handling.md","path":"/downloads/go/cobra/v1-10-2/file-handling.md"},{"slug":"injection","title":"Injection","description":"Configuring flag annotations for legacy Bash completion in Cobra commands.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/injection.md","path":"/downloads/go/cobra/v1-10-2/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining command-line interfaces and argument parsing rules to ensure malformed or out-of-contract inputs are rejected before execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/input-contract-definition.md","path":"/downloads/go/cobra/v1-10-2/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring Cobra command execution and flag parsing behavior to prevent input interpretation bypasses and unauthorized subcommand execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/input-interpretation-safety.md","path":"/downloads/go/cobra/v1-10-2/input-interpretation-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When generating Fish shell completion files using `GenFishCompletionFile` in Cobra applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/output-encoding.md","path":"/downloads/go/cobra/v1-10-2/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Developing Cobra command execution logic, hooks, or handlers that perform operations requiring operation timeouts or cancellation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/resource-exhaustion.md","path":"/downloads/go/cobra/v1-10-2/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Deploying and executing Cobra CLI applications in automated, containerized, or restricted production environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/runtime-environment-hardening.md","path":"/downloads/go/cobra/v1-10-2/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Populating dynamic completion messages using `AppendActiveHelp` in Cobra command definitions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/secret-handling.md","path":"/downloads/go/cobra/v1-10-2/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When implementing global security controls, token validation, user authentication, or privilege checks in parent command PersistentPreRun hooks within Cobra CLI applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/cobra/v1-10-2/security-control-integrity.md","path":"/downloads/go/cobra/v1-10-2/security-control-integrity.md"}]}]},{"slug":"echo","name":"Echo","latestVersion":"v5-3-1","versions":[{"version":"v5.3.1","versionSlug":"v5-3-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/echo/v5-3-1/","path":"/libraries/go/echo/v5-3-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1.md","bundlePath":"/downloads/go/echo/v5-3-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/0_security_blueprint.md","blueprintPath":"/downloads/go/echo/v5-3-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When building route handlers with middleware such as KeyAuth that allows requests to continue even when authentication fails or is absent.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/access-control.md","path":"/downloads/go/echo/v5-3-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring redirect middleware or trailing slash handling where explicit HTTP redirect status codes must be provided to ensure protocol compliance and prevent open redirect vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/api-contract-misuse.md","path":"/downloads/go/echo/v5-3-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing custom validator callback functions for authentication middleware such as BasicAuth or KeyAuth to verify credentials securely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/authentication.md","path":"/downloads/go/echo/v5-3-1/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When registering URL rewrite middleware in Echo to ensure path transformations occur before route matching and route-level security enforcement.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/boundary-control.md","path":"/downloads/go/echo/v5-3-1/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"Generating custom security tokens, nonces, or secrets in application workflows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/cryptography.md","path":"/downloads/go/echo/v5-3-1/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring CSRF middleware protection for web applications and REST APIs to prevent cross-site request forgery.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/csrf.md","path":"/downloads/go/echo/v5-3-1/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"Serving static files and assets through Echo middleware or route groups while preventing path traversal vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/file-handling.md","path":"/downloads/go/echo/v5-3-1/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Use when binding request payloads, query parameters, path variables, or form data to ensure untrusted input conforms to required types, structures, and value boundaries before executing handler logic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/input-contract-definition.md","path":"/downloads/go/echo/v5-3-1/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring cross-origin resource sharing for Echo web applications using explicit allow lists or dynamic origin callback validation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/input-interpretation-safety.md","path":"/downloads/go/echo/v5-3-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Setting up response security headers like Content-Security-Policy, HSTS, X-Frame-Options, and X-Content-Type-Options in Echo handlers or middleware.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/interface-protocol-hardening.md","path":"/downloads/go/echo/v5-3-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Setting up proxy middleware or handling client IP addresses in Echo to prevent spoofing of X-Real-IP and X-Forwarded-For headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/network-boundary.md","path":"/downloads/go/echo/v5-3-1/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Developing Echo web applications and handling incoming HTTP requests, multipart forms, compressed payloads, or long-running tasks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/resource-exhaustion.md","path":"/downloads/go/echo/v5-3-1/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring Echo's HTTP error handling and runtime environment parameters for production deployments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/runtime-environment-hardening.md","path":"/downloads/go/echo/v5-3-1/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When configuring HTTP request loggers or body dump handlers in Echo to prevent sensitive data such as tokens, passwords, and private parameters from being written to logs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/echo/v5-3-1/secret-handling.md","path":"/downloads/go/echo/v5-3-1/secret-handling.md"}]}]},{"slug":"fiber","name":"Fiber","latestVersion":"v3-4-0","versions":[{"version":"v3.4.0","versionSlug":"v3-4-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/fiber/v3-4-0/","path":"/libraries/go/fiber/v3-4-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0.md","bundlePath":"/downloads/go/fiber/v3-4-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/0_security_blueprint.md","blueprintPath":"/downloads/go/fiber/v3-4-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Implementing authentication or access control middleware in a Fiber route chain to protect endpoints against unauthorized access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/access-control.md","path":"/downloads/go/fiber/v3-4-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Parsing and binding incoming request data using `c.Bind()`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/api-contract-misuse.md","path":"/downloads/go/fiber/v3-4-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When configuring authentication mechanisms such as basic authentication or key-based token validation in Fiber applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/authentication.md","path":"/downloads/go/fiber/v3-4-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When implementing HTTP redirection back to the originating request context using `c.Redirect().Back()`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/boundary-control.md","path":"/downloads/go/fiber/v3-4-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring server TLS parameters and certificate management options in ListenConfig to ensure deterministic and unambiguous security configuration precedence.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/configuration-source-integrity.md","path":"/downloads/go/fiber/v3-4-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Registering users, verifying login credentials, or issuing session identifiers and API tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/cryptography.md","path":"/downloads/go/fiber/v3-4-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"When protecting state-changing routes against cross-site request forgery using Fiber's CSRF middleware and extractors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/csrf.md","path":"/downloads/go/fiber/v3-4-0/csrf.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"A handler renders a template, or accepts template text, a formula, or another expression from the caller.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/dangerous-execution.md","path":"/downloads/go/fiber/v3-4-0/dangerous-execution.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Integrating net/http handlers with Fiber and propagating request context.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/escape-hatch.md","path":"/downloads/go/fiber/v3-4-0/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"Handling user input to serve or access files via `c.Download()`, `c.SendFile()`, or custom path resolution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/file-handling.md","path":"/downloads/go/fiber/v3-4-0/file-handling.md"},{"slug":"injection","title":"Injection","description":"When accepting dynamic sort parameters from user-driven query strings for database sorting in Fiber applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/injection.md","path":"/downloads/go/fiber/v3-4-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Use when binding and validating incoming request parameters, query strings, headers, or body payloads to ensure input conforms to expected types, structures, and required field criteria before process…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/input-contract-definition.md","path":"/downloads/go/fiber/v3-4-0/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Handling user-supplied query parameters or HTTP headers to determine redirect destinations in Fiber route handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/input-driven-boundary-selection.md","path":"/downloads/go/fiber/v3-4-0/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When configuring application routing paths or binding request parameters where inconsistent decoding or ambiguous parameter origins could lead to alternate interpretations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/input-interpretation-safety.md","path":"/downloads/go/fiber/v3-4-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"When configuring Fiber application routing, global configurations, and middleware to process incoming HTTP requests strictly according to expected methods and content semantics.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/interface-protocol-hardening.md","path":"/downloads/go/fiber/v3-4-0/interface-protocol-hardening.md"},{"slug":"memory-safety","title":"Memory Safety","description":"When handling requests, passing context values or header slices to background goroutines, or retaining parsed data beyond request handler execution in Fiber.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/memory-safety.md","path":"/downloads/go/fiber/v3-4-0/memory-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When deploying Fiber applications behind reverse proxies, load balancers, or when configuring server network and transport security settings.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/network-boundary.md","path":"/downloads/go/fiber/v3-4-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When populating `RedirectConfig.Queries` with untrusted data for `c.Redirect().Route()` in Fiber applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/output-encoding.md","path":"/downloads/go/fiber/v3-4-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When initializing Fiber applications and handling incoming HTTP requests or background operations that require strict bounds on payload size and execution time.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/resource-exhaustion.md","path":"/downloads/go/fiber/v3-4-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring Fiber runtime execution mode for production deployment to manage socket reuse and process isolation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/runtime-environment-hardening.md","path":"/downloads/go/fiber/v3-4-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring encryption keys and ensuring proper value redaction in Fiber middleware components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/secret-handling.md","path":"/downloads/go/fiber/v3-4-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When initializing application middleware and setting up global security controls in Fiber to ensure protections remain enabled, correctly ordered, and consistently applied across all execution paths i…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/security-control-integrity.md","path":"/downloads/go/fiber/v3-4-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Use when managing session lifecycles, setting expiration limits, and interacting with request context sessions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/session-management.md","path":"/downloads/go/fiber/v3-4-0/session-management.md"}]}]},{"slug":"gin","name":"Gin","latestVersion":"v1-12-0","versions":[{"version":"v1.12.0","versionSlug":"v1-12-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/gin/v1-12-0/","path":"/libraries/go/gin/v1-12-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0.md","bundlePath":"/downloads/go/gin/v1-12-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/0_security_blueprint.md","blueprintPath":"/downloads/go/gin/v1-12-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When implementing authentication or authorization middleware in Gin to prevent unauthorized actions and enforce access control.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/access-control.md","path":"/downloads/go/gin/v1-12-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When rendering redirects using `render.Redirect` within a Gin application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/api-contract-misuse.md","path":"/downloads/go/gin/v1-12-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing credential verification and establishing user identity for protected HTTP routes using built-in authentication middleware.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/authentication.md","path":"/downloads/go/gin/v1-12-0/authentication.md"},{"slug":"cryptography","title":"Cryptography","description":"Registering users, verifying login credentials, or issuing session identifiers and API tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/cryptography.md","path":"/downloads/go/gin/v1-12-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Setting session or authentication cookies using `gin.Context` for stateful web applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/csrf.md","path":"/downloads/go/gin/v1-12-0/csrf.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"A handler renders a template, or accepts template text, a formula, or another expression from the caller.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/dangerous-execution.md","path":"/downloads/go/gin/v1-12-0/dangerous-execution.md"},{"slug":"file-handling","title":"File Handling","description":"Handling file uploads from multipart forms in Gin handlers and saving them to the local filesystem.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/file-handling.md","path":"/downloads/go/gin/v1-12-0/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building a SQL query where any part of the statement comes from a bound struct field, path parameter, or query parameter.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/injection.md","path":"/downloads/go/gin/v1-12-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Handling incoming HTTP request payloads or path parameters and enforcing required fields, types, and input constraints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/input-contract-definition.md","path":"/downloads/go/gin/v1-12-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When routing needs to evaluate raw percent-encoded request paths rather than unescaped paths to prevent validation and policy bypass.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/input-interpretation-safety.md","path":"/downloads/go/gin/v1-12-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring reverse proxy boundaries and managing incoming request forwarding headers in Gin applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/interface-protocol-hardening.md","path":"/downloads/go/gin/v1-12-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring trusted upstream proxies or load balancers for Gin routers to accurately parse client IP headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/network-boundary.md","path":"/downloads/go/gin/v1-12-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When serving JSON payloads that may be embedded directly inside HTML templates or web view contexts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/output-encoding.md","path":"/downloads/go/gin/v1-12-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Processing multipart form uploads in Gin applications to prevent memory exhaustion and Denial of Service.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/resource-exhaustion.md","path":"/downloads/go/gin/v1-12-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"initializing the Gin application engine for a production environment to disable internal debugging outputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/runtime-environment-hardening.md","path":"/downloads/go/gin/v1-12-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring request logging and panic recovery middleware to prevent sensitive credentials, tokens, and query parameters from appearing in log outputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/secret-handling.md","path":"/downloads/go/gin/v1-12-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When configuring panic recovery middleware in Gin applications to ensure clean error handling and prevent uncontrolled status code overwrites.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/security-control-integrity.md","path":"/downloads/go/gin/v1-12-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When issuing session cookies using Gin's `Context.SetCookie` and `Context.SetSameSite` methods.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/session-management.md","path":"/downloads/go/gin/v1-12-0/session-management.md"}]}]},{"slug":"goa","name":"Goa","latestVersion":"v3-28-0","versions":[{"version":"v3.28.0","versionSlug":"v3-28-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/goa/v3-28-0/","path":"/libraries/go/goa/v3-28-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0.md","bundlePath":"/downloads/go/goa/v3-28-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/0_security_blueprint.md","blueprintPath":"/downloads/go/goa/v3-28-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Defining health check, liveness probe, or management endpoints in the Goa DSL that need to bypass inherited global security requirements.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/access-control.md","path":"/downloads/go/goa/v3-28-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Implementing custom Goa server interceptors to inspect, validate, or mutate requests and responses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/api-contract-misuse.md","path":"/downloads/go/goa/v3-28-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When writing custom authentication handlers and security functions in Goa services to verify credentials, check token validity, and validate scopes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/authentication.md","path":"/downloads/go/goa/v3-28-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When routing incoming HTTP and gRPC traffic to service implementations and handling data payloads at the application boundary.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/boundary-control.md","path":"/downloads/go/goa/v3-28-0/boundary-control.md"},{"slug":"csrf","title":"CSRF","description":"When defining HTTP session or authentication cookies in Goa design definitions to prevent cross-site request forgery.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/csrf.md","path":"/downloads/go/goa/v3-28-0/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"When configuring static file serving and asset routing using Goa's design DSL.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/file-handling.md","path":"/downloads/go/goa/v3-28-0/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining API service payloads, parameters, headers, cookies, or agent tool arguments using Goa's design DSL to reject malformed or out-of-contract inputs before processing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/input-contract-definition.md","path":"/downloads/go/goa/v3-28-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Implementing custom unmarshaling logic for Go types used as string attributes or HTTP path and query parameters in Goa designs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/input-interpretation-safety.md","path":"/downloads/go/goa/v3-28-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Use when defining routing, HTTP endpoints, headers, cookies, and gRPC mappings in Goa service design specifications to ensure strict protocol framing and parameter enforcement.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/interface-protocol-hardening.md","path":"/downloads/go/goa/v3-28-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Developing or configuring Goa microservices that sit behind an API gateway, load balancer, or reverse proxy and consume incoming request metadata or forwarding headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/network-boundary.md","path":"/downloads/go/goa/v3-28-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Defining HTTP responses with a `Content-Type` of `text/html` or `text/plain` in Goa service designs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/output-encoding.md","path":"/downloads/go/goa/v3-28-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring connection retry behaviors and stream options for JSON-RPC WebSocket connections in Goa services.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/resource-exhaustion.md","path":"/downloads/go/goa/v3-28-0/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Instantiating model clients or initializing services that require third-party API keys or sensitive credentials.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/secret-handling.md","path":"/downloads/go/goa/v3-28-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When implementing custom server interceptors, wrapping generated endpoints, or managing execution paths in Goa services to ensure security controls run first and fail closed.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/security-control-integrity.md","path":"/downloads/go/goa/v3-28-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Mapping response cookies in Goa HTTP DSL to protect session identifiers and sensitive state from eavesdropping and client-side script access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/goa/v3-28-0/session-management.md","path":"/downloads/go/goa/v3-28-0/session-management.md"}]}]},{"slug":"gorm","name":"Gorm","latestVersion":"v1-31-2","versions":[{"version":"v1.31.2","versionSlug":"v1-31-2","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/gorm/v1-31-2/","path":"/libraries/go/gorm/v1-31-2/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2.md","bundlePath":"/downloads/go/gorm/v1-31-2.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/0_security_blueprint.md","blueprintPath":"/downloads/go/gorm/v1-31-2/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Use when querying, updating, or deleting records to ensure that unauthorized actors cannot bypass soft-delete boundaries, expose sensitive fields, or execute unconstrained destructive queries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/access-control.md","path":"/downloads/go/gorm/v1-31-2/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When executing row scans with GORM's `Scan` API and utilizing the returned results in authorization, authentication, or business logic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/api-contract-misuse.md","path":"/downloads/go/gorm/v1-31-2/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Persisting structs with relationships such as `BelongsTo`, `HasOne`, `HasMany`, or `Many2Many` using untrusted input.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/boundary-control.md","path":"/downloads/go/gorm/v1-31-2/boundary-control.md"},{"slug":"deserialization","title":"Deserialization","description":"When implementing custom field serializers using `schema.RegisterSerializer` or custom `Scanner` types where database values are received as empty interfaces.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/deserialization.md","path":"/downloads/go/gorm/v1-31-2/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"When constructing database queries dynamically where table or column names might be influenced by user input.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/escape-hatch.md","path":"/downloads/go/gorm/v1-31-2/escape-hatch.md"},{"slug":"injection","title":"Injection","description":"When building query clauses, raw statements, custom valuers, associations, or joins where dynamic or untrusted input is included in database operations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/injection.md","path":"/downloads/go/gorm/v1-31-2/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When creating database records from user-controlled input structs or maps to enforce input structure and field boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/input-contract-definition.md","path":"/downloads/go/gorm/v1-31-2/input-contract-definition.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring GORM database instances and executing queries that require bounds on execution time or connection duration.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/resource-exhaustion.md","path":"/downloads/go/gorm/v1-31-2/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When configuring GORM loggers or implementing custom loggers to prevent the exposure of secrets, tokens, and personal data in query execution logs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/secret-handling.md","path":"/downloads/go/gorm/v1-31-2/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Use when performing model updates, deletions, or session configurations where lifecycle hooks enforce critical security validations, audit logging, or field transformations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/security-control-integrity.md","path":"/downloads/go/gorm/v1-31-2/security-control-integrity.md"}]}]},{"slug":"ollama","name":"Ollama","latestVersion":"v0-32-5","versions":[{"version":"v0.32.5","versionSlug":"v0-32-5","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/ollama/v0-32-5/","path":"/libraries/go/ollama/v0-32-5/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5.md","bundlePath":"/downloads/go/ollama/v0-32-5.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/0_security_blueprint.md","blueprintPath":"/downloads/go/ollama/v0-32-5/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring chat sessions and agent workflows where models can execute external tools or perform sensitive actions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/access-control.md","path":"/downloads/go/ollama/v0-32-5/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When building OpenAI compatibility adapter requests and passing input items to `convertResponsesContent`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/api-contract-misuse.md","path":"/downloads/go/ollama/v0-32-5/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When configuring UI server instances and handling requests to application UI endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/authentication.md","path":"/downloads/go/ollama/v0-32-5/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Developing multi-tenant model serving endpoints where clients supply model names and paths that must be restricted to authorized tenant namespaces.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/boundary-control.md","path":"/downloads/go/ollama/v0-32-5/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When configuring base URLs, environment variables, model tokenizer files, or integration settings for Ollama to prevent untrusted or ambiguous sources from altering security behavior.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/configuration-source-integrity.md","path":"/downloads/go/ollama/v0-32-5/configuration-source-integrity.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Running Ollama agent sessions in environments where local shell command execution by the model is unsafe or unmonitored.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/dangerous-execution.md","path":"/downloads/go/ollama/v0-32-5/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"Use when loading, parsing, or creating model files from untrusted user inputs or local paths in Ollama model workflows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/deserialization.md","path":"/downloads/go/ollama/v0-32-5/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Persisting authentication tokens, backing up configurations, and processing user file uploads or extensions in Ollama.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/file-handling.md","path":"/downloads/go/ollama/v0-32-5/file-handling.md"},{"slug":"injection","title":"Injection","description":"Passing user messages, tool definitions, or tool arguments into the FunctionGemma renderer where control tokens could break prompt encapsulation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/injection.md","path":"/downloads/go/ollama/v0-32-5/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When building and handling API requests, generating model outputs, and configuring parameters in Ollama.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/input-contract-definition.md","path":"/downloads/go/ollama/v0-32-5/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Processing untrusted user strings, custom prompt templates, tokenizer encodings, and inline control tokens before passing them to model inference handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/input-interpretation-safety.md","path":"/downloads/go/ollama/v0-32-5/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"When proxying requests and responses between clients and cloud endpoints","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/interface-protocol-hardening.md","path":"/downloads/go/ollama/v0-32-5/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring network endpoints, proxy targets, remote model destinations, and subprocess bindings across trust boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/network-boundary.md","path":"/downloads/go/ollama/v0-32-5/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When building multi-turn chat sessions or text generation pipelines where prompt sizes or conversation histories risk exceeding model context window bounds.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/resource-exhaustion.md","path":"/downloads/go/ollama/v0-32-5/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"When configuring production builds that utilize webview interfaces to ensure developer inspection tools and context menus are disabled.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/runtime-environment-hardening.md","path":"/downloads/go/ollama/v0-32-5/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When logging execution environments or configuration maps for model runners that may contain sensitive credentials.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/secret-handling.md","path":"/downloads/go/ollama/v0-32-5/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When initializing SQLite database connections for data storage and state management.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/ollama/v0-32-5/security-control-integrity.md","path":"/downloads/go/ollama/v0-32-5/security-control-integrity.md"}]}]},{"slug":"traefik","name":"Traefik","latestVersion":"v3-7-10","versions":[{"version":"v3.7.10","versionSlug":"v3-7-10","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/go/traefik/v3-7-10/","path":"/libraries/go/traefik/v3-7-10/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10.md","bundlePath":"/downloads/go/traefik/v3-7-10.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/0_security_blueprint.md","blueprintPath":"/downloads/go/traefik/v3-7-10/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When configuring authentication and authorization middleware to evaluate token claims and enforce role or scope constraints before forwarding requests to backend services.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/access-control.md","path":"/downloads/go/traefik/v3-7-10/access-control.md"},{"slug":"authentication","title":"Authentication","description":"Use when defining static or dynamic user credentials, hashed passwords, or token keys for BasicAuth, DigestAuth, or API Key middleware configurations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/authentication.md","path":"/downloads/go/traefik/v3-7-10/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When configuring Traefik Kubernetes Ingress, CRD, and Gateway providers to isolate tenant boundaries and prevent unauthorized resource discovery or cross-namespace references.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/boundary-control.md","path":"/downloads/go/traefik/v3-7-10/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring key-value stores such as Consul, Etcd, Redis, or ZooKeeper as dynamic configuration providers for Traefik.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/configuration-source-integrity.md","path":"/downloads/go/traefik/v3-7-10/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring ACME certificate resolvers to issue TLS certificates with appropriate cryptographic key strengths.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/cryptography.md","path":"/downloads/go/traefik/v3-7-10/cryptography.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Configuring the Traefik Ingress NGINX provider where untrusted ingress authors might supply custom metadata annotations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/escape-hatch.md","path":"/downloads/go/traefik/v3-7-10/escape-hatch.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Configuring router and service names in key-value stores to ensure compliance with expected naming syntax and prevent syntax misuse.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/input-contract-definition.md","path":"/downloads/go/traefik/v3-7-10/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring HTTP entrypoints to protect static file servers and downstream backends from relative directory traversal attempts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/input-interpretation-safety.md","path":"/downloads/go/traefik/v3-7-10/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Setting up entryPoints or dynamic routing configurations where unencrypted traffic must be automatically redirected to secure HTTPS endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/interface-protocol-hardening.md","path":"/downloads/go/traefik/v3-7-10/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Defining routers, ingress routes, and provider bindings that expose backend services across network interfaces.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/network-boundary.md","path":"/downloads/go/traefik/v3-7-10/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring load balancing retries, upstream timeouts, active/passive health checks, and circuit breakers for backend services.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/resource-exhaustion.md","path":"/downloads/go/traefik/v3-7-10/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring container deployment for Traefik to run with least privilege and reduced attack surface.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/runtime-environment-hardening.md","path":"/downloads/go/traefik/v3-7-10/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Defining routing rules and service metadata for orchestrator providers like Docker, Swarm, ECS, Consul, and Nomad.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/secret-handling.md","path":"/downloads/go/traefik/v3-7-10/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring security middleware, rate limiting backends, or TLS default options where failure handling and execution order must prevent security control bypass or degradation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/security-control-integrity.md","path":"/downloads/go/traefik/v3-7-10/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session or sticky session cookies across Traefik routing, middleware, and backend service configurations to protect tokens from interception and client-side script theft.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/go/traefik/v3-7-10/session-management.md","path":"/downloads/go/traefik/v3-7-10/session-management.md"}]}]}]},{"slug":"java","label":"Java","catalogUrl":"https://securitycards.rewarelabs.com/llms/java.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java.md","libraries":[{"slug":"caffeine","name":"Caffeine","latestVersion":"v3-2-4","versions":[{"version":"v3.2.4","versionSlug":"v3-2-4","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/caffeine/v3-2-4/","path":"/libraries/java/caffeine/v3-2-4/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/caffeine/v3-2-4.md","bundlePath":"/downloads/java/caffeine/v3-2-4.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/caffeine/v3-2-4/0_security_blueprint.md","blueprintPath":"/downloads/java/caffeine/v3-2-4/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Use when constructing caches, configuring custom weighers, and interacting with cache methods or map views to ensure required arguments, non-null values, and valid signatures are correctly provided.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/caffeine/v3-2-4/api-contract-misuse.md","path":"/downloads/java/caffeine/v3-2-4/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Sharing JCache instances across application security boundaries where mutable objects are stored and accessed.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/caffeine/v3-2-4/boundary-control.md","path":"/downloads/java/caffeine/v3-2-4/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When loading external configuration resources for Caffeine JCache using `CacheManager.getURI()` and `TypesafeConfigurator`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/caffeine/v3-2-4/configuration-source-integrity.md","path":"/downloads/java/caffeine/v3-2-4/configuration-source-integrity.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Configuring JCache integrations that dynamically instantiate classes from configuration settings using TypesafeConfigurator.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/caffeine/v3-2-4/dangerous-execution.md","path":"/downloads/java/caffeine/v3-2-4/dangerous-execution.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When building caches or handling asynchronous computations in Caffeine to prevent unbounded heap memory consumption and thread starvation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/caffeine/v3-2-4/resource-exhaustion.md","path":"/downloads/java/caffeine/v3-2-4/resource-exhaustion.md"}]}]},{"slug":"gson","name":"Gson","latestVersion":"gson-parent-2-14-0","versions":[{"version":"gson.parent.2.14.0","versionSlug":"gson-parent-2-14-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/gson/gson-parent-2-14-0/","path":"/libraries/java/gson/gson-parent-2-14-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0.md","bundlePath":"/downloads/java/gson/gson-parent-2-14-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/0_security_blueprint.md","blueprintPath":"/downloads/java/gson/gson-parent-2-14-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When controlling data exposure and preventing unauthorized field population during object-to-JSON and JSON-to-object conversions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/access-control.md","path":"/downloads/java/gson/gson-parent-2-14-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When implementing custom `JsonDeserializer` or configuring type adapters and deserialization contexts to prevent infinite recursion, stack overflows, and runtime type errors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/api-contract-misuse.md","path":"/downloads/java/gson/gson-parent-2-14-0/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Use when serializing or deserializing Java records or inaccessible types where data crosses untrusted application boundaries and runtime reflection must be strictly controlled.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/boundary-control.md","path":"/downloads/java/gson/gson-parent-2-14-0/boundary-control.md"},{"slug":"csrf","title":"CSRF","description":"serializing sensitive data served to web clients via JSON endpoints to prevent script-sourcing data theft.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/csrf.md","path":"/downloads/java/gson/gson-parent-2-14-0/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"When configuring GsonBuilder and designing classes for deserialization to prevent unsafe object instantiation, bypass of constructors, and invalid state processing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/deserialization.md","path":"/downloads/java/gson/gson-parent-2-14-0/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"When defining custom type adapters using `jsonAdapter` annotations or registering type adapter instances that require instantiation without relying on low-level JVM unsafe mechanisms.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/escape-hatch.md","path":"/downloads/java/gson/gson-parent-2-14-0/escape-hatch.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When defining Java classes that will be populated via JSON deserialization and you need to enforce strict field contracts and allowed input keys.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/input-contract-definition.md","path":"/downloads/java/gson/gson-parent-2-14-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing untrusted JSON input streams or strings where strict RFC-compliant interpretation and duplicate key rejection are required to prevent parser differentials and input validation bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/input-interpretation-safety.md","path":"/downloads/java/gson/gson-parent-2-14-0/input-interpretation-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Serializing objects or writing JSON output that may be embedded directly into web responses, HTML documents, or script contexts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/output-encoding.md","path":"/downloads/java/gson/gson-parent-2-14-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Parsing untrusted JSON input streams using JsonReader to prevent stack overflow from deep nesting.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/resource-exhaustion.md","path":"/downloads/java/gson/gson-parent-2-14-0/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Serializing or deserializing objects that contain sensitive fields such as passwords, secrets, or internal tokens to prevent unauthorized exposure.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/secret-handling.md","path":"/downloads/java/gson/gson-parent-2-14-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring global type adapters and domain model classes while relying on consistent serialization and deserialization controls.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/gson/gson-parent-2-14-0/security-control-integrity.md","path":"/downloads/java/gson/gson-parent-2-14-0/security-control-integrity.md"}]}]},{"slug":"hibernate-orm","name":"Hibernate Orm","latestVersion":"7-4-5","versions":[{"version":"7.4.5","versionSlug":"7-4-5","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/hibernate-orm/7-4-5/","path":"/libraries/java/hibernate-orm/7-4-5/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5.md","bundlePath":"/downloads/java/hibernate-orm/7-4-5.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/0_security_blueprint.md","blueprintPath":"/downloads/java/hibernate-orm/7-4-5/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Enabling multi-tenancy in Hibernate session factories and configuring tenant identification for data isolation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/access-control.md","path":"/downloads/java/hibernate-orm/7-4-5/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When executing HQL queries with pessimistic locking to protect against concurrent modifications and race conditions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/api-contract-misuse.md","path":"/downloads/java/hibernate-orm/7-4-5/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When initializing, injecting, or managing `EntityManager` or `Session` instances across multi-threaded application environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/boundary-control.md","path":"/downloads/java/hibernate-orm/7-4-5/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring event listeners or initializing the SessionFactory in Hibernate.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/configuration-source-integrity.md","path":"/downloads/java/hibernate-orm/7-4-5/configuration-source-integrity.md"},{"slug":"deserialization","title":"Deserialization","description":"Mapping basic attributes whose Java types implement `java.io.Serializable` inside Hibernate domain entities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/deserialization.md","path":"/downloads/java/hibernate-orm/7-4-5/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"When registering custom StatementInspector instances to inspect or modify SQL statements before execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/escape-hatch.md","path":"/downloads/java/hibernate-orm/7-4-5/escape-hatch.md"},{"slug":"injection","title":"Injection","description":"Building HQL, JPQL, or native SQL queries that incorporate dynamic values or collection inputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/injection.md","path":"/downloads/java/hibernate-orm/7-4-5/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When defining entity models and persistence lifecycle operations to ensure input data matches required constraints, allowed types, and length limits.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/input-contract-definition.md","path":"/downloads/java/hibernate-orm/7-4-5/input-contract-definition.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring database connectivity, connection pools, and lifecycle management for production deployments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/resource-exhaustion.md","path":"/downloads/java/hibernate-orm/7-4-5/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring the persistence layer or runtime environment for production deployment.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/runtime-environment-hardening.md","path":"/downloads/java/hibernate-orm/7-4-5/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring database connections and initializing `EntityManagerFactory` or `StandardServiceRegistry` in Hibernate ORM applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/secret-handling.md","path":"/downloads/java/hibernate-orm/7-4-5/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring, programmatically executing, or automating database schema migrations and validation actions to prevent inconsistent states or destructive changes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/hibernate-orm/7-4-5/security-control-integrity.md","path":"/downloads/java/hibernate-orm/7-4-5/security-control-integrity.md"}]}]},{"slug":"jsoup","name":"Jsoup","latestVersion":"jsoup-1-23-1","versions":[{"version":"jsoup.1.23.1","versionSlug":"jsoup-1-23-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/jsoup/jsoup-1-23-1/","path":"/libraries/java/jsoup/jsoup-1-23-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1.md","bundlePath":"/downloads/java/jsoup/jsoup-1-23-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/0_security_blueprint.md","blueprintPath":"/downloads/java/jsoup/jsoup-1-23-1/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When programmatically setting attributes, querying text nodes, or instantiating attributes using Jsoup.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/api-contract-misuse.md","path":"/downloads/java/jsoup/jsoup-1-23-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When configuring HTTP or proxy authentication for Jsoup connection sessions and requests to verify identity and supply credentials.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/authentication.md","path":"/downloads/java/jsoup/jsoup-1-23-1/authentication.md"},{"slug":"injection","title":"Injection","description":"Building dynamic CSS selector queries or regex pseudo-selectors using untrusted user input.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/injection.md","path":"/downloads/java/jsoup/jsoup-1-23-1/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When validating untrusted DOM nodes or HTML fragments against expected structure, namespaces, and safelist rules before processing or rendering.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/input-contract-definition.md","path":"/downloads/java/jsoup/jsoup-1-23-1/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When parsing untrusted HTML/XML streams, resolving relative URLs, or processing input attributes and character entities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/input-interpretation-safety.md","path":"/downloads/java/jsoup/jsoup-1-23-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Making HTTP POST or HEAD requests where redirect semantics must be explicitly controlled to prevent automatic re-transmission of sensitive payloads across network boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/interface-protocol-hardening.md","path":"/downloads/java/jsoup/jsoup-1-23-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring outbound HTTP/HTTPS connections and sessions to route traffic through authorized proxy endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/network-boundary.md","path":"/downloads/java/jsoup/jsoup-1-23-1/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When outputting untrusted data into HTML or attribute contexts or serializing documents to string representations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/output-encoding.md","path":"/downloads/java/jsoup/jsoup-1-23-1/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"fetching and parsing remote content, network connections, or untrusted HTML and XML inputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/resource-exhaustion.md","path":"/downloads/java/jsoup/jsoup-1-23-1/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring request authenticators and handling sensitive headers or session tokens during connection requests across different origins or persistent thread pools.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/secret-handling.md","path":"/downloads/java/jsoup/jsoup-1-23-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When configuring and sharing Safelist and Cleaner instances across multiple concurrent threads in jsoup applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/security-control-integrity.md","path":"/downloads/java/jsoup/jsoup-1-23-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Managing multi-step HTTP interactions and session state in `Jsoup` connections to preserve isolated path-scoped cookie contexts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/jsoup/jsoup-1-23-1/session-management.md","path":"/downloads/java/jsoup/jsoup-1-23-1/session-management.md"}]}]},{"slug":"kafka","name":"Kafka","latestVersion":"4-3-1","versions":[{"version":"4.3.1","versionSlug":"4-3-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/kafka/4-3-1/","path":"/libraries/java/kafka/4-3-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1.md","bundlePath":"/downloads/java/kafka/4-3-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/0_security_blueprint.md","blueprintPath":"/downloads/java/kafka/4-3-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When administering cluster security settings, defining topic or group access permissions, and configuring broker authorization mechanisms in Kafka.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/access-control.md","path":"/downloads/java/kafka/4-3-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Implementing retry logic, custom exception handlers, or error management across Kafka clients, admin operations, and producers to handle transient network issues without masking fatal security or stat…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/api-contract-misuse.md","path":"/downloads/java/kafka/4-3-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When developers are configuring Kafka clients or brokers with SASL authentication mechanisms such as PLAIN, SCRAM, or OAuthBearer to verify identities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/authentication.md","path":"/downloads/java/kafka/4-3-1/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Building Kafka Streams or Kafka Connect applications that must safely isolate production errors, deserialization failures, or unprocessable records without causing data loss or application downtime.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/boundary-control.md","path":"/downloads/java/kafka/4-3-1/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring security provider class names and dynamically instantiating Java Security Providers via `security.providers` configuration settings.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/configuration-source-integrity.md","path":"/downloads/java/kafka/4-3-1/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring OAuthBearer client assertions and signing algorithms when establishing secure authentication mechanisms in Kafka clients.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/cryptography.md","path":"/downloads/java/kafka/4-3-1/cryptography.md"},{"slug":"deserialization","title":"Deserialization","description":"When parsing untrusted JSON payloads or template configuration files in Kafka Connect or client security components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/deserialization.md","path":"/downloads/java/kafka/4-3-1/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring Kerberos keytab files for authentication in Kafka environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/file-handling.md","path":"/downloads/java/kafka/4-3-1/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When building ACL bindings, filters, or administrative configuration requests in Kafka applications to ensure all resource types, pattern types, operations, and permission types are explicitly specifi…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/input-contract-definition.md","path":"/downloads/java/kafka/4-3-1/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When validating topic names in client applications or via topic policies to ensure unambiguous input interpretation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/input-interpretation-safety.md","path":"/downloads/java/kafka/4-3-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Developing or configuring Kafka custom transport layers, network handlers, or protocol authentication mechanisms where incoming request headers and API keys must be strictly verified.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/interface-protocol-hardening.md","path":"/downloads/java/kafka/4-3-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring administrative or management connections to Kafka KRaft cluster controllers to ensure control-plane endpoints remain segregated from data-plane client traffic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/network-boundary.md","path":"/downloads/java/kafka/4-3-1/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Setting up administrative quotas, throttling policies, and group membership limits to prevent Denial of Service from excessive producer, consumer, or coordinator loads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/resource-exhaustion.md","path":"/downloads/java/kafka/4-3-1/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring brokers, clients, connectors, or mirror makers where sensitive credentials like passwords, private keys, and client secrets need to be supplied securely without hardcoding plaintext values…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/secret-handling.md","path":"/downloads/java/kafka/4-3-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Developing Kafka producers that send records to a cluster and must ensure delivery persistence and transaction reliability.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/security-control-integrity.md","path":"/downloads/java/kafka/4-3-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When configuring client connections and broker security parameters for SASL authentication to ensure session expiration and periodic re-authentication.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/kafka/4-3-1/session-management.md","path":"/downloads/java/kafka/4-3-1/session-management.md"}]}]},{"slug":"keycloak","name":"Keycloak","latestVersion":"26-7-0","versions":[{"version":"26.7.0","versionSlug":"26-7-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/keycloak/26-7-0/","path":"/libraries/java/keycloak/26-7-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0.md","bundlePath":"/downloads/java/keycloak/26-7-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/0_security_blueprint.md","blueprintPath":"/downloads/java/keycloak/26-7-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When developers and administrators are configuring permissions, assigning roles, or managing client access to ensure users and services only have access to required resources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/access-control.md","path":"/downloads/java/keycloak/26-7-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing credential issuance workflows where verifiable credentials must be signed using specific credential body objects and signers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/api-contract-misuse.md","path":"/downloads/java/keycloak/26-7-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Setting up user credential policies, password hashing, brute-force protection, and authentication flows requiring secondary or multi-factor verification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/authentication.md","path":"/downloads/java/keycloak/26-7-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Exchanging an authorization code for an access token at the server boundary where request parameters cross into state validation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/boundary-control.md","path":"/downloads/java/keycloak/26-7-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When importing realm representations programmatically and configuring settings such as brute force protection attributes to ensure configuration integrity and prevent validation failures.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/configuration-source-integrity.md","path":"/downloads/java/keycloak/26-7-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring cryptographic signature algorithms, document encryption, and token verification settings for SAML and OIDC protocols.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/cryptography.md","path":"/downloads/java/keycloak/26-7-0/cryptography.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When defining parameterized scopes, configuring user profile attributes, or setting OIDC token endpoint request parameter constraints in Keycloak.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/input-contract-definition.md","path":"/downloads/java/keycloak/26-7-0/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When querying decision evaluation endpoints for resources defined with wildcard URIs in Keycloak authorization requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/input-driven-boundary-selection.md","path":"/downloads/java/keycloak/26-7-0/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When implementing OAuth 2.0 or OID4VC credential issuance workflows requiring parsing and validation of Rich Authorization Requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/input-interpretation-safety.md","path":"/downloads/java/keycloak/26-7-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Developing or configuring client integrations and protocol endpoints in Keycloak to prevent parameter pollution, cross-interface abuse, and request smuggling.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/interface-protocol-hardening.md","path":"/downloads/java/keycloak/26-7-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring transport security, reverse proxy headers, and trusted proxy addresses for Keycloak realms, administration, and inter-node communication.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/network-boundary.md","path":"/downloads/java/keycloak/26-7-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Parsing incoming deflated SAML HTTP-Redirect or POST bindings in Keycloak endpoints and adapters to prevent decompression bombs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/resource-exhaustion.md","path":"/downloads/java/keycloak/26-7-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring Keycloak for production deployment to replace volatile or development environments with production-grade backends.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/runtime-environment-hardening.md","path":"/downloads/java/keycloak/26-7-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When running Admin CLI commands or configuring local tool sessions that generate configuration files containing active tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/secret-handling.md","path":"/downloads/java/keycloak/26-7-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When configuring client authentication flow overrides, defining client policies, or upgrading client configurations in Keycloak to ensure security controls remain correctly applied and do not fail ope…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/security-control-integrity.md","path":"/downloads/java/keycloak/26-7-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Developing or configuring Keycloak realms, clients, and custom providers to enforce strict session lifespans, validate active session state, and perform session revocation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/keycloak/26-7-0/session-management.md","path":"/downloads/java/keycloak/26-7-0/session-management.md"}]}]},{"slug":"netty","name":"Netty","latestVersion":"netty-4-2-16-final","versions":[{"version":"netty.4.2.16.final","versionSlug":"netty-4-2-16-final","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/netty/netty-4-2-16-final/","path":"/libraries/java/netty/netty-4-2-16-final/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final.md","bundlePath":"/downloads/java/netty/netty-4-2-16-final.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/0_security_blueprint.md","blueprintPath":"/downloads/java/netty/netty-4-2-16-final/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Implementing custom Netty `ChannelHandler` authorization logic or managing outbound proxy connections via `HttpProxyHandler` or `Socks5ProxyHandler`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/access-control.md","path":"/downloads/java/netty/netty-4-2-16-final/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing or maintaining channel handlers in Netty pipelines that process inbound and outbound events and handle uncaught exceptions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/api-contract-misuse.md","path":"/downloads/java/netty/netty-4-2-16-final/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Configuring mutual TLS (mTLS) authentication for QUIC servers in Netty to ensure connecting clients are properly authenticated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/authentication.md","path":"/downloads/java/netty/netty-4-2-16-final/authentication.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring `SslContext` and client connections for Netty secure communications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/cryptography.md","path":"/downloads/java/netty/netty-4-2-16-final/cryptography.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Configuring class resolution for dynamic loading or setting up native library working directories in Netty applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/dangerous-execution.md","path":"/downloads/java/netty/netty-4-2-16-final/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"When configuring decoders like `CompatibleMarshallingDecoder` to unmarshal network byte streams into Java objects.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/deserialization.md","path":"/downloads/java/netty/netty-4-2-16-final/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Use when performing reflective access to internal classes, constructors, or fields, or when dynamically loading providers via reflection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/escape-hatch.md","path":"/downloads/java/netty/netty-4-2-16-final/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"Handling incoming HTTP multipart form uploads, file uploads, and temporary attributes in Netty.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/file-handling.md","path":"/downloads/java/netty/netty-4-2-16-final/file-handling.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring network protocol decoders, HTTP codecs, and frame decoders to ingest untrusted data safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/input-interpretation-safety.md","path":"/downloads/java/netty/netty-4-2-16-final/input-interpretation-safety.md"},{"slug":"memory-safety","title":"Memory Safety","description":"Managing the lifecycle of Netty's `ReferenceCountedOpenSslContext` and `ReferenceCountedOpenSslEngine` native resources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/memory-safety.md","path":"/downloads/java/netty/netty-4-2-16-final/memory-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Developing local inter-process communication (IPC) channels, server sockets, or datagram connections using Netty transports that require strict interface isolation and peer validation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/network-boundary.md","path":"/downloads/java/netty/netty-4-2-16-final/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Use when constructing HTTP/2 headers or translating HTTP/1.x objects to HTTP/2 frames to prevent header injection and control character smuggling.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/output-encoding.md","path":"/downloads/java/netty/netty-4-2-16-final/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Setting up Netty network services, QUIC servers, or SSL contexts where malicious clients could trigger resource exhaustion or memory denial-of-service.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/resource-exhaustion.md","path":"/downloads/java/netty/netty-4-2-16-final/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring Netty applications in environments enforcing Java SecurityManager restrictions, modular encapsulation, or custom platform permissions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/runtime-environment-hardening.md","path":"/downloads/java/netty/netty-4-2-16-final/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring QUIC SSL contexts in non-development environments to prevent dumping session secrets.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/secret-handling.md","path":"/downloads/java/netty/netty-4-2-16-final/secret-handling.md"},{"slug":"session-management","title":"Session Management","description":"When instantiating server SSL contexts and setting explicit upper bounds for session cache size and timeouts to prevent unbounded memory consumption from cached TLS sessions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/netty/netty-4-2-16-final/session-management.md","path":"/downloads/java/netty/netty-4-2-16-final/session-management.md"}]}]},{"slug":"quarkus","name":"Quarkus","latestVersion":"3-38-0","versions":[{"version":"3.38.0","versionSlug":"3-38-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/quarkus/3-38-0/","path":"/libraries/java/quarkus/3-38-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0.md","bundlePath":"/downloads/java/quarkus/3-38-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/0_security_blueprint.md","blueprintPath":"/downloads/java/quarkus/3-38-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring Kubernetes RBAC permissions and role bindings using Quarkus deployment properties for application workloads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/access-control.md","path":"/downloads/java/quarkus/3-38-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When registering custom OpenAPI filters to sanitize or adjust API schemas using Quarkus smallrye-openapi.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/api-contract-misuse.md","path":"/downloads/java/quarkus/3-38-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing WebAuthn multi-factor authentication or binding access tokens to client certificates in mTLS environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/authentication.md","path":"/downloads/java/quarkus/3-38-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Configuring OpenTelemetry tracing, span attributes, exporters, and telemetry endpoints in Quarkus applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/boundary-control.md","path":"/downloads/java/quarkus/3-38-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring security controls in Quarkus using both configuration files and programmatic builders simultaneously.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/configuration-source-integrity.md","path":"/downloads/java/quarkus/3-38-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"You are implementing user registration or credential update workflows where passwords must be securely hashed prior to storage.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/cryptography.md","path":"/downloads/java/quarkus/3-38-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Building web forms or REST endpoints in Quarkus that handle state-changing browser requests using ambient credentials and require anti-CSRF token protection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/csrf.md","path":"/downloads/java/quarkus/3-38-0/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"Deserializing untrusted incoming data streams such as Kafka records or JSON payloads in Quarkus applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/deserialization.md","path":"/downloads/java/quarkus/3-38-0/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"When configuring local filesystem static file paths and endpoints in Quarkus applications to serve web resources securely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/file-handling.md","path":"/downloads/java/quarkus/3-38-0/file-handling.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Implementing custom tenant resolution via `TenantResolver` or `TenantConfigResolver` in a Quarkus OIDC multi-tenancy application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/input-driven-boundary-selection.md","path":"/downloads/java/quarkus/3-38-0/input-driven-boundary-selection.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring network transport schemes and protocol versions for WebSocket communication in production environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/interface-protocol-hardening.md","path":"/downloads/java/quarkus/3-38-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring outbound REST client connections, OIDC integration, and Keycloak policy enforcer endpoints that communicate across network trust boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/network-boundary.md","path":"/downloads/java/quarkus/3-38-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring OIDC bearer token authentication in Quarkus applications to handle remote token introspection and UserInfo endpoint responses efficiently.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/resource-exhaustion.md","path":"/downloads/java/quarkus/3-38-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Developing or packaging Quarkus applications as GraalVM native images where dynamic reflection, native initialization, and proxy configurations are required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/runtime-environment-hardening.md","path":"/downloads/java/quarkus/3-38-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When configuring authentication client secrets, database passwords, SSL key store passwords, and third-party service credentials in Quarkus applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/secret-handling.md","path":"/downloads/java/quarkus/3-38-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring incoming Kafka messaging consumers in Quarkus to protect against resource exhaustion caused by unacknowledged records.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/security-control-integrity.md","path":"/downloads/java/quarkus/3-38-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session cookies and form authentication in Quarkus web applications to protect authentication state against cross-site scripting and unauthorized interception.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/session-management.md","path":"/downloads/java/quarkus/3-38-0/session-management.md"}]}]},{"slug":"shiro","name":"Shiro","latestVersion":"shiro-root-3-0-0","versions":[{"version":"shiro.root.3.0.0","versionSlug":"shiro-root-3-0-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/shiro/shiro-root-3-0-0/","path":"/libraries/java/shiro/shiro-root-3-0-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0.md","bundlePath":"/downloads/java/shiro/shiro-root-3-0-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/0_security_blueprint.md","blueprintPath":"/downloads/java/shiro/shiro-root-3-0-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When defining wildcard permissions, setting up role permission resolvers, or configuring case sensitivity for resource identifiers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/access-control.md","path":"/downloads/java/shiro/shiro-root-3-0-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When configuring realms, filters, session management, and authentication tokens in Apache Shiro applications to prevent API contract violations and runtime exceptions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/api-contract-misuse.md","path":"/downloads/java/shiro/shiro-root-3-0-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Authorizing sensitive operations and managing authenticated versus remembered user states.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/authentication.md","path":"/downloads/java/shiro/shiro-root-3-0-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When programmatically creating a Subject context using `SecurityManager.createSubject()` or `Subject.Builder` and executing operations that rely on the security context boundary.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/boundary-control.md","path":"/downloads/java/shiro/shiro-root-3-0-0/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"When managing remember-me encryption keys and utilizing stream-based cipher operations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/cryptography.md","path":"/downloads/java/shiro/shiro-root-3-0-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring authentication and web filter chains where state-changing actions such as user logout must be protected against Cross-Site Request Forgery.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/csrf.md","path":"/downloads/java/shiro/shiro-root-3-0-0/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"When managing remembered user identity payloads via `AbstractRememberMeManager` in Apache Shiro to prevent deserialization vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/deserialization.md","path":"/downloads/java/shiro/shiro-root-3-0-0/deserialization.md"},{"slug":"injection","title":"Injection","description":"When configuring custom SQL queries for authentication, roles, or permissions in `JdbcRealm`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/injection.md","path":"/downloads/java/shiro/shiro-root-3-0-0/injection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing and interpreting untrusted format strings or class identifiers when obtaining dynamic `HashFormat` instances.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/input-interpretation-safety.md","path":"/downloads/java/shiro/shiro-root-3-0-0/input-interpretation-safety.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Handling passwords, encryption keys, and system secrets during authentication token creation, hashing, LDAP configuration, or cipher key setup in Apache Shiro.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/secret-handling.md","path":"/downloads/java/shiro/shiro-root-3-0-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When overriding default Shiro web filters, global configurations, or custom Spring bean definitions in a web application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/security-control-integrity.md","path":"/downloads/java/shiro/shiro-root-3-0-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring Apache Shiro session management and persistence mechanisms for production applications requiring durable sessions across application restarts and clustered deployments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/session-management.md","path":"/downloads/java/shiro/shiro-root-3-0-0/session-management.md"}]}]},{"slug":"spring-framework","name":"Spring Framework","latestVersion":"v7-0-8","versions":[{"version":"v7.0.8","versionSlug":"v7-0-8","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/spring-framework/v7-0-8/","path":"/libraries/java/spring-framework/v7-0-8/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8.md","bundlePath":"/downloads/java/spring-framework/v7-0-8.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/0_security_blueprint.md","blueprintPath":"/downloads/java/spring-framework/v7-0-8/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Developing or configuring interceptors, CORS rules, and HTTP requests requiring role-based access control or tenant isolation in Spring MVC and WebFlux applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/access-control.md","path":"/downloads/java/spring-framework/v7-0-8/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When validating target objects, invoking validators programmatically, or handling complex nested property paths using Spring validation utilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/api-contract-misuse.md","path":"/downloads/java/spring-framework/v7-0-8/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When supplying per-request dynamic credentials using UserCredentialsConnectionFactoryAdapter for JMS connections.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/authentication.md","path":"/downloads/java/spring-framework/v7-0-8/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Configuring test request builders, mock servlets, and request boundaries where URI paths, context paths, and servlet paths are processed to ensure path-based security controls evaluate correct URI seg…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/boundary-control.md","path":"/downloads/java/spring-framework/v7-0-8/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When configuring application environment properties and essential settings during application startup.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/configuration-source-integrity.md","path":"/downloads/java/spring-framework/v7-0-8/configuration-source-integrity.md"},{"slug":"deserialization","title":"Deserialization","description":"When configuring HTTP message converters in Spring MVC to control allowed payload formats and prevent unintended deserialization.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/deserialization.md","path":"/downloads/java/spring-framework/v7-0-8/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Handling user-supplied file paths and resolving them against a storage root directory.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/file-handling.md","path":"/downloads/java/spring-framework/v7-0-8/file-handling.md"},{"slug":"injection","title":"Injection","description":"Parsing and evaluating dynamic or user-influenced SpEL expressions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/injection.md","path":"/downloads/java/spring-framework/v7-0-8/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When developers need to enforce Jakarta Bean Validation rules, nested object checks, and container element constraints across services, domain objects, and message payloads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/input-contract-definition.md","path":"/downloads/java/spring-framework/v7-0-8/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing and validating untrusted URLs, request paths, or class names where alternate interpretations or parser differentials could bypass security checks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/input-interpretation-safety.md","path":"/downloads/java/spring-framework/v7-0-8/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Developing controllers, functional endpoints, or reactive server responses that serve sensitive data or require client-side security headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/interface-protocol-hardening.md","path":"/downloads/java/spring-framework/v7-0-8/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring dynamic HTTP redirects in Spring MVC applications where targets must be restricted to allowed internal domains.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/network-boundary.md","path":"/downloads/java/spring-framework/v7-0-8/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When constructing dynamic redirect URLs with RedirectView to prevent open redirect vulnerabilities and URL injection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/output-encoding.md","path":"/downloads/java/spring-framework/v7-0-8/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When bounding input parameters, data binders, database query collection parameters, and streaming decoders to prevent excessive memory or connection consumption.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/resource-exhaustion.md","path":"/downloads/java/spring-framework/v7-0-8/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring application production runtime environments, logging levels, and debugging properties for Spring components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/runtime-environment-hardening.md","path":"/downloads/java/spring-framework/v7-0-8/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When logging diagnostic information, writing error messages, or handling database and messaging credentials in Spring applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/secret-handling.md","path":"/downloads/java/spring-framework/v7-0-8/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring Spring WebMVC path matching configurations or implementing AOP security proxies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/security-control-integrity.md","path":"/downloads/java/spring-framework/v7-0-8/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Developing and configuring session cookie resolvers, response cookies, or managing cookie security attributes in Spring Web applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/session-management.md","path":"/downloads/java/spring-framework/v7-0-8/session-management.md"}]}]},{"slug":"spring-security","name":"Spring Security","latestVersion":"7-1-0","versions":[{"version":"7.1.0","versionSlug":"7-1-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/java/spring-security/7-1-0/","path":"/libraries/java/spring-security/7-1-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0.md","bundlePath":"/downloads/java/spring-security/7-1-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/0_security_blueprint.md","blueprintPath":"/downloads/java/spring-security/7-1-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring HTTP request authorization rules and default fallback restrictions across servlet or reactive applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/access-control.md","path":"/downloads/java/spring-security/7-1-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When enabling feature DSLs like `.oneTimeTokenLogin()` that require explicitly provided handlers or service beans to prevent context initialization or runtime failures.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/api-contract-misuse.md","path":"/downloads/java/spring-security/7-1-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Integrating SAML 2.0 authentication providers and validating signed responses and assertions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/authentication.md","path":"/downloads/java/spring-security/7-1-0/authentication.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Use when configuring cross-origin request handling, registering CORS filters, or defining CORS configuration sources for servlet or reactive Spring Security applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/configuration-source-integrity.md","path":"/downloads/java/spring-security/7-1-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring cryptographic signature verification, message signing, and encryption for SAML 2.0 components and OAuth 2.0 JWT tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/cryptography.md","path":"/downloads/java/spring-security/7-1-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring Spring Security `HttpSecurity` or `ServerHttpSecurity` for web applications relying on cookie-based sessions or browser interactions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/csrf.md","path":"/downloads/java/spring-security/7-1-0/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"Configuring custom row mappers or credential deserializers via `setRowMapper(...)` or `setCredentialsDeserializer(...)` in `JdbcAssertingPartyMetadataRepository`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/deserialization.md","path":"/downloads/java/spring-security/7-1-0/deserialization.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Implementing dynamic client registration in Spring Security OAuth 2.0 Authorization Server to handle custom metadata inputs securely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/input-contract-definition.md","path":"/downloads/java/spring-security/7-1-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring JWT decoders for OAuth 2.0 and validating incoming token type headers to ensure security decisions use unambiguous token purpose interpretations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/input-interpretation-safety.md","path":"/downloads/java/spring-security/7-1-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Developing or configuring OAuth 2.0 / OIDC clients, resource servers, authorization endpoints, and redirection callbacks where framing, caching headers, method constraints, and strict URI validation m…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/interface-protocol-hardening.md","path":"/downloads/java/spring-security/7-1-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Deploying Spring Security applications behind a reverse proxy or load balancer to ensure that OAuth 2.0 redirect URIs resolve accurately using trusted network configuration.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/network-boundary.md","path":"/downloads/java/spring-security/7-1-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Handling initial user authentication and subsequent requests to prevent CPU and memory exhaustion caused by repeated password hashing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/resource-exhaustion.md","path":"/downloads/java/spring-security/7-1-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring the application environment for production deployment.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/runtime-environment-hardening.md","path":"/downloads/java/spring-security/7-1-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring OAuth2 clients, resources, or token introspection in Spring Security applications where credentials and client secrets are required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/secret-handling.md","path":"/downloads/java/spring-security/7-1-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When implementing custom validation logic for OAuth2 authorization requests or pushed authorization requests to prevent bypassing validation checks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/security-control-integrity.md","path":"/downloads/java/spring-security/7-1-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Handling user logout, clearing remember-me cookies, and managing OIDC or server-side session termination.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/java/spring-security/7-1-0/session-management.md","path":"/downloads/java/spring-security/7-1-0/session-management.md"}]}]}]},{"slug":"javascript","label":"JavaScript","catalogUrl":"https://securitycards.rewarelabs.com/llms/javascript.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript.md","libraries":[{"slug":"axios","name":"Axios","latestVersion":"v1-19-0","versions":[{"version":"v1.19.0","versionSlug":"v1-19-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/axios/v1-19-0/","path":"/libraries/javascript/axios/v1-19-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0.md","bundlePath":"/downloads/javascript/axios/v1-19-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/0_security_blueprint.md","blueprintPath":"/downloads/javascript/axios/v1-19-0/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring Axios requests when custom response status validation or proper error throwing on 4xx or 5xx status codes is required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/api-contract-misuse.md","path":"/downloads/javascript/axios/v1-19-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When establishing and verifying user or service identity using HTTP Basic authentication, Bearer tokens, or custom headers in Axios requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/authentication.md","path":"/downloads/javascript/axios/v1-19-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When appending shared sensitive payload fields or headers using request interceptors or `transformRequest` in Axios.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/boundary-control.md","path":"/downloads/javascript/axios/v1-19-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Combining untrusted user inputs or external configurations into Axios request options, headers, authentication settings, or query parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/configuration-source-integrity.md","path":"/downloads/javascript/axios/v1-19-0/configuration-source-integrity.md"},{"slug":"csrf","title":"CSRF","description":"Making cross-origin requests using Axios where anti-CSRF token headers must be attached safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/csrf.md","path":"/downloads/javascript/axios/v1-19-0/csrf.md"},{"slug":"injection","title":"Injection","description":"Setting custom request headers or handling dynamic inputs intended for HTTP headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/injection.md","path":"/downloads/javascript/axios/v1-19-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Making HTTP or HTTPS requests using Axios with untrusted dynamic endpoint URLs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/input-contract-definition.md","path":"/downloads/javascript/axios/v1-19-0/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Building request paths using dynamic user input combined with a `baseURL` in Axios.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/input-driven-boundary-selection.md","path":"/downloads/javascript/axios/v1-19-0/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing untrusted HTTP header directives and parameters where keys must be safely interpreted without allowing prototype pollution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/input-interpretation-safety.md","path":"/downloads/javascript/axios/v1-19-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Making HTTPS requests in Node.js using Axios where custom TLS verification options or custom CA certificates are required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/interface-protocol-hardening.md","path":"/downloads/javascript/axios/v1-19-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring network proxy options and `NO_PROXY` bypass rules for Axios requests across corporate or restricted network boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/network-boundary.md","path":"/downloads/javascript/axios/v1-19-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Making HTTP requests or streaming large payloads to and from untrusted servers or endpoints where payload expansion or unconstrained data transfers can exhaust memory and network resources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/resource-exhaustion.md","path":"/downloads/javascript/axios/v1-19-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring build environments, CI/CD pipelines, or package installations that process sensitive credentials and require minimized runtime attack surfaces.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/runtime-environment-hardening.md","path":"/downloads/javascript/axios/v1-19-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring authentication headers, sensitive fields, and credentials for HTTP requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/secret-handling.md","path":"/downloads/javascript/axios/v1-19-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Registering multiple request and response interceptors to apply security controls, authorization headers, or cryptographic signatures.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/security-control-integrity.md","path":"/downloads/javascript/axios/v1-19-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When making requests from a frontend application to a cross-origin API that relies on session cookies for authentication.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/session-management.md","path":"/downloads/javascript/axios/v1-19-0/session-management.md"}]}]},{"slug":"commander-js","name":"Commander Js","latestVersion":"v15-0-0","versions":[{"version":"v15.0.0","versionSlug":"v15-0-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/commander-js/v15-0-0/","path":"/libraries/javascript/commander-js/v15-0-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0.md","bundlePath":"/downloads/javascript/commander-js/v15-0-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/0_security_blueprint.md","blueprintPath":"/downloads/javascript/commander-js/v15-0-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Developing administrative or internal CLI subcommands and options where sensitive actions must be restricted regardless of whether help documentation suppresses their display.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/access-control.md","path":"/downloads/javascript/commander-js/v15-0-0/access-control.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Defining sensitive, internal, or administrative CLI subcommands and options that should not cross trust boundaries or leak into typo suggestions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/boundary-control.md","path":"/downloads/javascript/commander-js/v15-0-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When binding CLI options to environment variables using `.env()` or handling ambient process configuration values.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/configuration-source-integrity.md","path":"/downloads/javascript/commander-js/v15-0-0/configuration-source-integrity.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Defining stand-alone executable subcommands with `.command(name, description, opts)` where process spawning or binary name resolution occurs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/dangerous-execution.md","path":"/downloads/javascript/commander-js/v15-0-0/dangerous-execution.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining command-line options and arguments that require strict input validation boundaries and enumerated value allowlisting.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/input-contract-definition.md","path":"/downloads/javascript/commander-js/v15-0-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When writing custom argument or option parser functions in Commander to parse untrusted user input.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/input-interpretation-safety.md","path":"/downloads/javascript/commander-js/v15-0-0/input-interpretation-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When configuring custom output hooks via `program.configureOutput()` to handle error messages or command output containing untrusted user input before rendering to stdout or stderr streams.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/output-encoding.md","path":"/downloads/javascript/commander-js/v15-0-0/output-encoding.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Defining options or arguments that handle sensitive values or tokens to ensure they are not leaked in plaintext through automated help documentation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/secret-handling.md","path":"/downloads/javascript/commander-js/v15-0-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Embedding Commander inside long-running process environments, web services, or test runners where process.exit() should not be invoked on validation failure or help output.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/commander-js/v15-0-0/security-control-integrity.md","path":"/downloads/javascript/commander-js/v15-0-0/security-control-integrity.md"}]}]},{"slug":"express","name":"Express","latestVersion":"v5-2-1","versions":[{"version":"v5.2.1","versionSlug":"v5-2-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/express/v5-2-1/","path":"/libraries/javascript/express/v5-2-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1.md","bundlePath":"/downloads/javascript/express/v5-2-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/0_security_blueprint.md","blueprintPath":"/downloads/javascript/express/v5-2-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Developing route handlers that require role checks, ownership verifications, or tenant constraints before executing business logic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/access-control.md","path":"/downloads/javascript/express/v5-2-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Implementing request handlers, middleware functions, and routing logic in Express 5 applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/api-contract-misuse.md","path":"/downloads/javascript/express/v5-2-1/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When implementing authorization checks, security logging, or boundary access controls inside middleware or sub-applications mounted with prefix paths using `app.use()`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/boundary-control.md","path":"/downloads/javascript/express/v5-2-1/boundary-control.md"},{"slug":"csrf","title":"CSRF","description":"Developing state-changing Express endpoints, such as `POST` routes or session termination handlers, that rely on session cookies or issue sensitive cookies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/csrf.md","path":"/downloads/javascript/express/v5-2-1/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"Handling file downloads via `res.sendFile()` or serving static assets using `express.static()` with user-influenced input.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/file-handling.md","path":"/downloads/javascript/express/v5-2-1/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building database queries within Express handlers using user-supplied input.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/injection.md","path":"/downloads/javascript/express/v5-2-1/injection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Extracting and utilizing untrusted path parameters or wildcards captured by `path-to-regexp` v8 in Express 5 handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/input-interpretation-safety.md","path":"/downloads/javascript/express/v5-2-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"When configuring routing handlers and handling method dispatch in Express applications to prevent method confusion and protocol abuse.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/interface-protocol-hardening.md","path":"/downloads/javascript/express/v5-2-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Handling HTTP redirect responses where target URLs are derived from request parameters or untrusted inputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/network-boundary.md","path":"/downloads/javascript/express/v5-2-1/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When serving JSON or JSONP responses that may be embedded directly within HTML documents or inline script blocks in Express.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/output-encoding.md","path":"/downloads/javascript/express/v5-2-1/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring request body parsing middleware such as `express.json()`, `express.urlencoded()`, `express.text()`, or `express.raw()` in an Express application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/resource-exhaustion.md","path":"/downloads/javascript/express/v5-2-1/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"When deploying the Express application to production and configuring runtime environment variables or error handling middleware to prevent stack trace and debugging information disclosure.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/runtime-environment-hardening.md","path":"/downloads/javascript/express/v5-2-1/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring session middleware or cookie-parser secrets for Express applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/secret-handling.md","path":"/downloads/javascript/express/v5-2-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Building and structuring the Express application middleware stack and defining error-handling routes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/security-control-integrity.md","path":"/downloads/javascript/express/v5-2-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Handling user authentication and privilege elevation events in Express session middleware.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/session-management.md","path":"/downloads/javascript/express/v5-2-1/session-management.md"}]}]},{"slug":"fastify","name":"Fastify","latestVersion":"v5-9-0","versions":[{"version":"v5.9.0","versionSlug":"v5-9-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/fastify/v5-9-0/","path":"/libraries/javascript/fastify/v5-9-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0.md","bundlePath":"/downloads/javascript/fastify/v5-9-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/0_security_blueprint.md","blueprintPath":"/downloads/javascript/fastify/v5-9-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Developing and organizing route handlers, plugins, and custom request lifecycle hooks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/access-control.md","path":"/downloads/javascript/fastify/v5-9-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When registering request-scoped properties or managing HTTP response lifecycles in Fastify applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/api-contract-misuse.md","path":"/downloads/javascript/fastify/v5-9-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When registering routes that require verification of identity credentials or tokens in Fastify applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/authentication.md","path":"/downloads/javascript/fastify/v5-9-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Structuring routes that require different security policies, such as authentication, within a Fastify application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/boundary-control.md","path":"/downloads/javascript/fastify/v5-9-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When instantiating and configuring a Fastify application instance with security-sensitive properties.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/configuration-source-integrity.md","path":"/downloads/javascript/fastify/v5-9-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring inbound webhook endpoints and establishing secure HTTPS transport for server instances.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/cryptography.md","path":"/downloads/javascript/fastify/v5-9-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Protecting session-authenticated and state-changing application endpoints (POST, PUT, PATCH, DELETE) against unauthorized actions initiated from untrusted origins.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/csrf.md","path":"/downloads/javascript/fastify/v5-9-0/csrf.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"When defining input validation and serialization schemas for Fastify routes, including querystrings, parameters, request bodies, and responses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/dangerous-execution.md","path":"/downloads/javascript/fastify/v5-9-0/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"When parsing external JSON strings using `JSON.parse()` or similar methods before processing the resulting object.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/deserialization.md","path":"/downloads/javascript/fastify/v5-9-0/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Developing Fastify route handlers or custom plugins that require low-level control over network responses or connection lifecycles.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/escape-hatch.md","path":"/downloads/javascript/fastify/v5-9-0/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"When manually serving static files or assets, defining custom static routes, or bypassing the standard response lifecycle using hijack.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/file-handling.md","path":"/downloads/javascript/fastify/v5-9-0/file-handling.md"},{"slug":"injection","title":"Injection","description":"When executing database queries using database integration plugins, such as `@fastify/mysql` or `@fastify/postgres`, within Fastify route handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/injection.md","path":"/downloads/javascript/fastify/v5-9-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Configuring validation schemas for request bodies, headers, query parameters, or route parameters in Fastify routes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/input-contract-definition.md","path":"/downloads/javascript/fastify/v5-9-0/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Implementing custom asynchronous route constraints to isolate tenant or resource boundaries based on incoming request headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/input-driven-boundary-selection.md","path":"/downloads/javascript/fastify/v5-9-0/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring Fastify instances and processing early request payloads or parameter inputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/input-interpretation-safety.md","path":"/downloads/javascript/fastify/v5-9-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring Fastify routing, response trailers, and trusted proxy settings to prevent HTTP request smuggling and protocol spoofing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/interface-protocol-hardening.md","path":"/downloads/javascript/fastify/v5-9-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When deploying a Fastify application in containerized, serverless, or reverse-proxied network environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/network-boundary.md","path":"/downloads/javascript/fastify/v5-9-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When setting dynamic response headers or executing redirects with untrusted parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/output-encoding.md","path":"/downloads/javascript/fastify/v5-9-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When registering custom serializers, writing hooks, or implementing validation definitions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/resource-exhaustion.md","path":"/downloads/javascript/fastify/v5-9-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"When configuring the production deployment pipeline, container specifications, and package definitions for a Fastify application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/runtime-environment-hardening.md","path":"/downloads/javascript/fastify/v5-9-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When managing TLS key material, certificates, and runtime credentials in Fastify.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/secret-handling.md","path":"/downloads/javascript/fastify/v5-9-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When configuring and initializing validation, custom schema compilers, or routing rules during the server setup and bootstrap phases.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/security-control-integrity.md","path":"/downloads/javascript/fastify/v5-9-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When initializing a Fastify server that handles user sessions and requires stable infrastructure resource management.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/session-management.md","path":"/downloads/javascript/fastify/v5-9-0/session-management.md"}]}]},{"slug":"graphql-js","name":"Graphql Js","latestVersion":"v17-0-2","versions":[{"version":"v17.0.2","versionSlug":"v17-0-2","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/graphql-js/v17-0-2/","path":"/libraries/javascript/graphql-js/v17-0-2/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2.md","bundlePath":"/downloads/javascript/graphql-js/v17-0-2.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/0_security_blueprint.md","blueprintPath":"/downloads/javascript/graphql-js/v17-0-2/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Use when implementing resolvers, domain logic, or field-level authorization checks to ensure that authenticated users can only access authorized resources and data records.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/access-control.md","path":"/downloads/javascript/graphql-js/v17-0-2/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When executing queries, incremental schemas, or subscriptions using low-level execution helpers in GraphQL.js v17.0.2.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/api-contract-misuse.md","path":"/downloads/javascript/graphql-js/v17-0-2/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Setting up the GraphQL request handler to verify and forward user identity and request credentials into the execution context.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/authentication.md","path":"/downloads/javascript/graphql-js/v17-0-2/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When building GraphQL validation rules for unauthenticated or public requests where unauthorized callers must not be allowed to inspect the full schema structure.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/boundary-control.md","path":"/downloads/javascript/graphql-js/v17-0-2/boundary-control.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Defining custom scalars like `GraphQLScalarType` that accept arbitrary or unconstrained JSON payloads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/escape-hatch.md","path":"/downloads/javascript/graphql-js/v17-0-2/escape-hatch.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Processing incoming GraphQL queries, mutations, and subscriptions before execution to ensure structural correctness and prevent malformed payloads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/input-contract-definition.md","path":"/downloads/javascript/graphql-js/v17-0-2/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When converting runtime JavaScript values to GraphQL AST literals using `astFromValue` with `GraphQLID` to ensure downstream consumers safely process varying literal node kinds.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/input-interpretation-safety.md","path":"/downloads/javascript/graphql-js/v17-0-2/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring HTTP endpoints and server-level middleware for GraphQL handlers to ensure expected protocol behavior, request methods, and content types.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/interface-protocol-hardening.md","path":"/downloads/javascript/graphql-js/v17-0-2/interface-protocol-hardening.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When configuring error handling for GraphQL execution to prevent leaking internal stack traces and system details in production environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/output-encoding.md","path":"/downloads/javascript/graphql-js/v17-0-2/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Parsing and validating incoming untrusted GraphQL query strings or documents to protect server resources against denial-of-service and resource exhaustion attacks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/resource-exhaustion.md","path":"/downloads/javascript/graphql-js/v17-0-2/resource-exhaustion.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When initializing GraphQL schemas, constructing custom execution pipelines, or configuring validation rules to prevent security control bypasses and unvalidated inputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/graphql-js/v17-0-2/security-control-integrity.md","path":"/downloads/javascript/graphql-js/v17-0-2/security-control-integrity.md"}]}]},{"slug":"handlebars-js","name":"Handlebars Js","latestVersion":"v4-7-9","versions":[{"version":"v4.7.9","versionSlug":"v4-7-9","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/handlebars-js/v4-7-9/","path":"/libraries/javascript/handlebars-js/v4-7-9/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9.md","bundlePath":"/downloads/javascript/handlebars-js/v4-7-9.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/0_security_blueprint.md","blueprintPath":"/downloads/javascript/handlebars-js/v4-7-9/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Rendering templates with context objects where prototype properties and methods must be restricted to prevent unauthorized access or prototype pollution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/access-control.md","path":"/downloads/javascript/handlebars-js/v4-7-9/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Rendering templates that use dynamic partial names resolved at runtime.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/api-contract-misuse.md","path":"/downloads/javascript/handlebars-js/v4-7-9/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Compiling Handlebars templates that utilize partials and require isolation of context data across boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/boundary-control.md","path":"/downloads/javascript/handlebars-js/v4-7-9/boundary-control.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Building and running applications using the standalone Handlebars runtime environment where dynamic template compilation is restricted.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/dangerous-execution.md","path":"/downloads/javascript/handlebars-js/v4-7-9/dangerous-execution.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"When wrapping custom string values to prevent Handlebars from applying automatic HTML escaping.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/escape-hatch.md","path":"/downloads/javascript/handlebars-js/v4-7-9/escape-hatch.md"},{"slug":"injection","title":"Injection","description":"Extending Handlebars.JavaScriptCompiler or programmatically invoking the precompiler API with custom configuration options.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/injection.md","path":"/downloads/javascript/handlebars-js/v4-7-9/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Compiling Handlebars templates that require explicit data bindings and property validations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/input-contract-definition.md","path":"/downloads/javascript/handlebars-js/v4-7-9/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Compiling template strings or processing custom abstract syntax trees in Handlebars to prevent parser bypass and AST type confusion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/input-interpretation-safety.md","path":"/downloads/javascript/handlebars-js/v4-7-9/input-interpretation-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering dynamic or user-supplied data within Handlebars templates and custom helpers to prevent cross-site scripting.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/output-encoding.md","path":"/downloads/javascript/handlebars-js/v4-7-9/output-encoding.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When compiling untrusted template strings to enforce strict compilation boundaries and prevent dynamic resolution of unlisted functions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/handlebars-js/v4-7-9/security-control-integrity.md","path":"/downloads/javascript/handlebars-js/v4-7-9/security-control-integrity.md"}]}]},{"slug":"joi","name":"Joi","latestVersion":"v18-2-3","versions":[{"version":"v18.2.3","versionSlug":"v18-2-3","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/joi/v18-2-3/","path":"/libraries/javascript/joi/v18-2-3/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3.md","bundlePath":"/downloads/javascript/joi/v18-2-3.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/0_security_blueprint.md","blueprintPath":"/downloads/javascript/joi/v18-2-3/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing data validation logic across different execution environments where specific library methods may be undefined or unsupported.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/api-contract-misuse.md","path":"/downloads/javascript/joi/v18-2-3/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Validating incoming date and time payloads against relative thresholds and dynamic state transitions using Joi schemas.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/boundary-control.md","path":"/downloads/javascript/joi/v18-2-3/boundary-control.md"},{"slug":"deserialization","title":"Deserialization","description":"Validating untrusted JSON payloads or parsed objects using `Joi.object()` schemas to protect against prototype pollution and mass assignment vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/deserialization.md","path":"/downloads/javascript/joi/v18-2-3/deserialization.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Building, extending, and compiling attribute-based object models or dynamic validation schemas from untrusted inputs and custom type definitions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/input-contract-definition.md","path":"/downloads/javascript/joi/v18-2-3/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Validating untrusted input where exact types and unambiguous string interpretations are security-critical.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/input-interpretation-safety.md","path":"/downloads/javascript/joi/v18-2-3/input-interpretation-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering Joi validation error messages or dynamic templates in HTML user interfaces where user-supplied input may be present.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/output-encoding.md","path":"/downloads/javascript/joi/v18-2-3/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Defining recursive validation schemas using Joi.link() to validate nested object hierarchies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/resource-exhaustion.md","path":"/downloads/javascript/joi/v18-2-3/resource-exhaustion.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Building and configuring Joi validation schemas using method chaining.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/joi/v18-2-3/security-control-integrity.md","path":"/downloads/javascript/joi/v18-2-3/security-control-integrity.md"}]}]},{"slug":"koa","name":"Koa","latestVersion":"v3-2-1","versions":[{"version":"v3.2.1","versionSlug":"v3-2-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/koa/v3-2-1/","path":"/libraries/javascript/koa/v3-2-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1.md","bundlePath":"/downloads/javascript/koa/v3-2-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/0_security_blueprint.md","blueprintPath":"/downloads/javascript/koa/v3-2-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Enforcing access control, verifying user roles, and managing request-scoped permissions across Koa middleware and route handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/access-control.md","path":"/downloads/javascript/koa/v3-2-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When throwing HTTP errors using `ctx.throw()` in Koa v3 to ensure proper argument types and signatures are supplied.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/api-contract-misuse.md","path":"/downloads/javascript/koa/v3-2-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing authentication middleware, protecting routes using context assertions, and issuing cryptographic session cookies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/authentication.md","path":"/downloads/javascript/koa/v3-2-1/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Configuring the Koa application instance to manage request-scoped data and error contexts safely across asynchronous execution boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/boundary-control.md","path":"/downloads/javascript/koa/v3-2-1/boundary-control.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"When implementing custom low-level streaming or response handling by setting `ctx.respond = false` to bypass Koa's built-in response pipeline.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/escape-hatch.md","path":"/downloads/javascript/koa/v3-2-1/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"Serving downloadable files and attachments to clients while preventing MIME-sniffing vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/file-handling.md","path":"/downloads/javascript/koa/v3-2-1/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Validating incoming request content types against acceptable MIME types prior to parsing or processing payload data in Koa applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/input-contract-definition.md","path":"/downloads/javascript/koa/v3-2-1/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Implementing hostname or subdomain-based request routing using `ctx.subdomains` or `ctx.hostname`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/input-driven-boundary-selection.md","path":"/downloads/javascript/koa/v3-2-1/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When updating query parameter handling and validation logic during migration to Koa v3.x where URLSearchParams replaces legacy querystring parsing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/input-interpretation-safety.md","path":"/downloads/javascript/koa/v3-2-1/input-interpretation-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When deploying a Koa application behind a reverse proxy to manage network trust boundaries and inspect proxy headers safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/network-boundary.md","path":"/downloads/javascript/koa/v3-2-1/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When rendering dynamic user input in Koa response bodies or redirect fallback messages to prevent HTML-context injection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/output-encoding.md","path":"/downloads/javascript/koa/v3-2-1/output-encoding.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Instantiating the Koa application in a production deployment to prevent development mode behaviors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/runtime-environment-hardening.md","path":"/downloads/javascript/koa/v3-2-1/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When configuring cookie signing keys and issuing signed cookies via `app.keys` in a Koa application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/secret-handling.md","path":"/downloads/javascript/koa/v3-2-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Developing or modifying Koa middleware functions that handle request routing, authorization, or context-population.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/security-control-integrity.md","path":"/downloads/javascript/koa/v3-2-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session identifiers, cookie attributes, and cryptographic keys using `ctx.cookies.set()` and `app.keys` in a Koa application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/session-management.md","path":"/downloads/javascript/koa/v3-2-1/session-management.md"}]}]},{"slug":"multer","name":"Multer","latestVersion":"v2-2-0","versions":[{"version":"v2.2.0","versionSlug":"v2-2-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/multer/v2-2-0/","path":"/libraries/javascript/multer/v2-2-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0.md","bundlePath":"/downloads/javascript/multer/v2-2-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/0_security_blueprint.md","blueprintPath":"/downloads/javascript/multer/v2-2-0/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When handling multipart file uploads in Express applications using Multer and implementing error-handling middleware or callback wrappers to capture size limits, filtering rejections, and parsing erro…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/api-contract-misuse.md","path":"/downloads/javascript/multer/v2-2-0/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Configuring file upload endpoints where multer is integrated into routing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/boundary-control.md","path":"/downloads/javascript/multer/v2-2-0/boundary-control.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Handling file upload endpoints where incoming multipart form data field boundaries and file counts must be strictly controlled.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/escape-hatch.md","path":"/downloads/javascript/multer/v2-2-0/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring disk storage for file uploads in Multer to manage temporary files safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/file-handling.md","path":"/downloads/javascript/multer/v2-2-0/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When defining endpoints that handle multipart form submissions and file uploads to reject unexpected fields, excess files, and unauthorized file uploads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/input-contract-definition.md","path":"/downloads/javascript/multer/v2-2-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Handling multipart file upload requests containing non-ASCII filenames or parameters transmitted without RFC 5987 extended syntax.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/input-interpretation-safety.md","path":"/downloads/javascript/multer/v2-2-0/input-interpretation-safety.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Setting up Multer middleware to process multipart form data and file uploads in a Node.js application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/resource-exhaustion.md","path":"/downloads/javascript/multer/v2-2-0/resource-exhaustion.md"}]}]},{"slug":"passport","name":"Passport","latestVersion":"v0-7-0","versions":[{"version":"v0.7.0","versionSlug":"v0-7-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/passport/v0-7-0/","path":"/libraries/javascript/passport/v0-7-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/passport/v0-7-0.md","bundlePath":"/downloads/javascript/passport/v0-7-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/passport/v0-7-0/0_security_blueprint.md","blueprintPath":"/downloads/javascript/passport/v0-7-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Implementing protected routes or dashboard endpoints where authentication strategies may pass execution or permit unauthenticated requests to proceed down the middleware stack.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/passport/v0-7-0/access-control.md","path":"/downloads/javascript/passport/v0-7-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring `passport.authenticate()` options or invoking asynchronous login and logout methods where API contract compliance is required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/passport/v0-7-0/api-contract-misuse.md","path":"/downloads/javascript/passport/v0-7-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Configuring standard authentication middleware routes or implementing custom callbacks with `passport.authenticate()`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/passport/v0-7-0/authentication.md","path":"/downloads/javascript/passport/v0-7-0/authentication.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When building applications that require isolated authentication contexts, such as multi-tenant systems or decoupled sub-applications running within the same process.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/passport/v0-7-0/security-control-integrity.md","path":"/downloads/javascript/passport/v0-7-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Implementing user login and logout workflows that manage persistent authentication sessions using Passport.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/passport/v0-7-0/session-management.md","path":"/downloads/javascript/passport/v0-7-0/session-management.md"}]}]},{"slug":"react","name":"React","latestVersion":"v19-2-7","versions":[{"version":"v19.2.7","versionSlug":"v19-2-7","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/react/v19-2-7/","path":"/libraries/javascript/react/v19-2-7/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/react/v19-2-7.md","bundlePath":"/downloads/javascript/react/v19-2-7.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/react/v19-2-7/0_security_blueprint.md","blueprintPath":"/downloads/javascript/react/v19-2-7/0_security_blueprint.md","categories":[{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring build toolchains, Rollup, Babel, or test tooling environments where source maps or debugger inspector flags could inadvertently expose internal repository structures, comments, and unminif…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/react/v19-2-7/configuration-source-integrity.md","path":"/downloads/javascript/react/v19-2-7/configuration-source-integrity.md"},{"slug":"injection","title":"Injection","description":"Building React components that accept and forward untrusted props or render dynamic content from component properties.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/react/v19-2-7/injection.md","path":"/downloads/javascript/react/v19-2-7/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When building React Server Actions that receive network inputs and parameters from clients.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/react/v19-2-7/input-contract-definition.md","path":"/downloads/javascript/react/v19-2-7/input-contract-definition.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Building asynchronous React Server Components or client components that read promises during render using the `use()` hook.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/react/v19-2-7/resource-exhaustion.md","path":"/downloads/javascript/react/v19-2-7/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When initializing React component state or restoring application persistence using browser storage and URL fragments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/react/v19-2-7/secret-handling.md","path":"/downloads/javascript/react/v19-2-7/secret-handling.md"}]}]},{"slug":"svelte-kit","name":"Svelte Kit","latestVersion":"sveltejs-kit-2-70-1","versions":[{"version":"sveltejs.kit.2.70.1","versionSlug":"sveltejs-kit-2-70-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/javascript/svelte-kit/sveltejs-kit-2-70-1/","path":"/libraries/javascript/svelte-kit/sveltejs-kit-2-70-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1.md","bundlePath":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/0_security_blueprint.md","blueprintPath":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Implementing server load functions, remote function handlers, or routes that handle sensitive user data and require access control verification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/access-control.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing SvelteKit pages with links that navigate to routes containing load functions or GET endpoints with side-effects.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/api-contract-misuse.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Verifying user authentication state and credentials inside server hooks before handling downstream request paths.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/authentication.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/authentication.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When defining and validating environment variables at application build and startup time using `defineEnvVars`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/configuration-source-integrity.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Generating secure tokens, identifiers, or random values in SvelteKit applications","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/cryptography.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring deployment environment variables or reverse proxy headers for production builds to ensure SvelteKit correctly validates the origin of incoming state-changing requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/csrf.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"Developing HTML forms or remote functions that accept file uploads to ensure binary payloads are correctly transmitted and validated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/file-handling.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Developing SvelteKit endpoints, remote functions, or dynamic routes that accept untrusted input parameters or request payloads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-contract-definition.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When performing client-side navigation using SvelteKit's `goto(...)` function to ensure external URLs are not passed into the internal routing utility.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-driven-boundary-selection.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Processing captured route segment parameters in SvelteKit `load` functions or endpoint handlers","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-interpretation-safety.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Setting up HTTP security headers, response modifications, and CORS policies during server-side rendering, request handling, or API route definitions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/interface-protocol-hardening.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Making server-side `fetch` requests inside load functions where automatic credential forwarding could leak authentication headers to external domains.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/network-boundary.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring deployment adapters or building request handling hooks in SvelteKit to restrict incoming payload sizes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/resource-exhaustion.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Developing and building SvelteKit applications that contain development-only debug overlays or diagnostic UI components which must be completely removed from production client bundles.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/runtime-environment-hardening.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Developing server-side data loading, backend modules, form actions, or build configurations that manage sensitive tokens, API keys, and credentials in SvelteKit.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/secret-handling.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Implementing custom error handling hooks in `src/hooks.server.js` to process server exceptions securely without leaking internal details.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/security-control-integrity.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Managing authenticated user sessions, setting session cookies, or handling user logout and revocation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/session-management.md","path":"/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/session-management.md"}]}]}]},{"slug":"kotlin","label":"Kotlin","catalogUrl":"https://securitycards.rewarelabs.com/llms/kotlin.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/kotlin.md","libraries":[{"slug":"ktor","name":"Ktor","latestVersion":"3-5-1","versions":[{"version":"3.5.1","versionSlug":"3-5-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/kotlin/ktor/3-5-1/","path":"/libraries/kotlin/ktor/3-5-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1.md","bundlePath":"/downloads/kotlin/ktor/3-5-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/0_security_blueprint.md","blueprintPath":"/downloads/kotlin/ktor/3-5-1/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring a custom `NSURLSession` for the Ktor Darwin client engine using `DarwinClientEngineConfig.usePreconfiguredSession`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/api-contract-misuse.md","path":"/downloads/kotlin/ktor/3-5-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When establishing and verifying token-based identity credentials using JSON Web Tokens in Ktor server applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/authentication.md","path":"/downloads/kotlin/ktor/3-5-1/authentication.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When loading configuration files and setting environment properties in Ktor applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/configuration-source-integrity.md","path":"/downloads/kotlin/ktor/3-5-1/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"When configuring cryptographic mechanisms such as HTTP digest authentication, session encryption transformers, and random nonce generation within Ktor applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/cryptography.md","path":"/downloads/kotlin/ktor/3-5-1/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"When implementing cross-site request forgery protection for state-changing HTTP requests using Ktor's CSRF plugin.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/csrf.md","path":"/downloads/kotlin/ktor/3-5-1/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"Serving static files, directories, or embedded classpath resources from user-supplied paths or URL parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/file-handling.md","path":"/downloads/kotlin/ktor/3-5-1/file-handling.md"},{"slug":"injection","title":"Injection","description":"When constructing dynamic LDAP queries or Distinguished Names using untrusted user inputs in Ktor server applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/injection.md","path":"/downloads/kotlin/ktor/3-5-1/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When validating incoming request bodies and handling malformed input data in Ktor applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/input-contract-definition.md","path":"/downloads/kotlin/ktor/3-5-1/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When validating, parsing, or normalizing untrusted URL strings, authentication headers, or cookie values to ensure security decisions rely on unambiguous interpretations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/input-interpretation-safety.md","path":"/downloads/kotlin/ktor/3-5-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Developing client applications using Ktor HTTP, SSE, or WebSocket engines where protocol framing, content types, and connection state must be strictly enforced.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/interface-protocol-hardening.md","path":"/downloads/kotlin/ktor/3-5-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring TLS connections and validating server certificates or hostnames in Ktor client applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/network-boundary.md","path":"/downloads/kotlin/ktor/3-5-1/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring Ktor client plugins such as `WebSockets` and `HttpRedirect` to handle remote network streams and untrusted server interactions safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/resource-exhaustion.md","path":"/downloads/kotlin/ktor/3-5-1/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring client logging for Ktor HTTP requests and responses that contain sensitive authentication headers or tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/secret-handling.md","path":"/downloads/kotlin/ktor/3-5-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When configuring authentication providers and routing paths where certain requests need to be treated as public or excluded from authentication requirements.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/security-control-integrity.md","path":"/downloads/kotlin/ktor/3-5-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Handling user logout actions and terminating active session states in Ktor server applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/ktor/3-5-1/session-management.md","path":"/downloads/kotlin/ktor/3-5-1/session-management.md"}]}]},{"slug":"okhttp","name":"Okhttp","latestVersion":"parent-5-4-0","versions":[{"version":"parent.5.4.0","versionSlug":"parent-5-4-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/kotlin/okhttp/parent-5-4-0/","path":"/libraries/kotlin/okhttp/parent-5-4-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0.md","bundlePath":"/downloads/kotlin/okhttp/parent-5-4-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/0_security_blueprint.md","blueprintPath":"/downloads/kotlin/okhttp/parent-5-4-0/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing network-enabled client applications using OkHttp public interfaces.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/api-contract-misuse.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing basic authentication, proxy authorization, or preemptive credential injection using `Authenticator`, `Credentials.basic()`, and custom interceptors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/authentication.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/authentication.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring build tools and dependency verification metadata for OkHttp artifacts to ensure configuration and supply-chain integrity.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/configuration-source-integrity.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring transport layer security, validating server certificates, or setting up custom certificate authorities and pinning on `OkHttpClient`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/cryptography.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Initiating OAuth 2.0 authorization flows and handling callbacks in network client applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/csrf.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/csrf.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When handling user-provided URLs or constructing network requests from external input to prevent validation and policy bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/input-interpretation-safety.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring network protocols and client connections where cleartext HTTP/2 without ALPN negotiation is required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/interface-protocol-hardening.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring TLS client certificates and custom handshake settings for OkHttp during local development or test setups.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/network-boundary.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring OkHttpClient instances to handle concurrent network traffic and prevent thread starvation or resource exhaustion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/resource-exhaustion.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring client behavior for handling HTTP redirects, ensuring transport security, and inspecting intermediate redirect hops.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/secret-handling.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/secret-handling.md"},{"slug":"session-management","title":"Session Management","description":"Handling OAuth authentication callbacks and authorization code exchanges.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/kotlin/okhttp/parent-5-4-0/session-management.md","path":"/downloads/kotlin/okhttp/parent-5-4-0/session-management.md"}]}]}]},{"slug":"php","label":"PHP","catalogUrl":"https://securitycards.rewarelabs.com/llms/php.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/php.md","libraries":[{"slug":"laravel","name":"Laravel","latestVersion":"v13-22-0","versions":[{"version":"v13.22.0","versionSlug":"v13-22-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/php/laravel/v13-22-0/","path":"/libraries/php/laravel/v13-22-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0.md","bundlePath":"/downloads/php/laravel/v13-22-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/0_security_blueprint.md","blueprintPath":"/downloads/php/laravel/v13-22-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring cross-origin resource sharing headers, allowed methods, allowed origins, and middleware routing constraints in Laravel applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/access-control.md","path":"/downloads/php/laravel/v13-22-0/access-control.md"},{"slug":"authentication","title":"Authentication","description":"Configuring authentication guards, token storage, and multi-guard request routing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/authentication.md","path":"/downloads/php/laravel/v13-22-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When registering a custom redirect handler using Authenticate::redirectUsing() to determine where unauthenticated users should be redirected.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/boundary-control.md","path":"/downloads/php/laravel/v13-22-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring application environment paths and loading configuration files in Laravel.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/configuration-source-integrity.md","path":"/downloads/php/laravel/v13-22-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Encrypting sensitive model attributes, session storage, environment configurations, and ensuring correct cipher and key length initialization.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/cryptography.md","path":"/downloads/php/laravel/v13-22-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"When building state-changing HTML forms, routing endpoints, or configuring CSRF middleware and session cookie policies to prevent cross-site request forgery attacks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/csrf.md","path":"/downloads/php/laravel/v13-22-0/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"When decrypting raw strings, cookies, or non-object values using `decrypt()` or `Encrypter` to prevent automatic PHP object instantiation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/deserialization.md","path":"/downloads/php/laravel/v13-22-0/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring, storing, publishing, or serving static files and assets to ensure they remain protected against unauthorized disclosure, traversal, or modification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/file-handling.md","path":"/downloads/php/laravel/v13-22-0/file-handling.md"},{"slug":"injection","title":"Injection","description":"When constructing database queries using user-controlled input in Laravel.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/injection.md","path":"/downloads/php/laravel/v13-22-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Handling incoming HTTP requests and processing user input data against defined validation rules and contracts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/input-contract-definition.md","path":"/downloads/php/laravel/v13-22-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When validating route parameters or path identifiers that undergo automatic URL decoding and require canonical interpretation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/input-interpretation-safety.md","path":"/downloads/php/laravel/v13-22-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring Cross-Origin Resource Sharing in `config/cors.php` and ensuring the `HandleCors` middleware properly manages origin boundaries and HTTP response headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/interface-protocol-hardening.md","path":"/downloads/php/laravel/v13-22-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring upstream proxy trust boundaries and forwarded headers within the application middleware setup.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/network-boundary.md","path":"/downloads/php/laravel/v13-22-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Writing feature tests to verify that rendered response content is properly HTML-escaped by default in Laravel applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/output-encoding.md","path":"/downloads/php/laravel/v13-22-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Use when configuring request rate limits or token repository throttles to defend application endpoints and authentication routes against burst traffic spikes, denial of service, and brute force attack…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/resource-exhaustion.md","path":"/downloads/php/laravel/v13-22-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring deployment environments and application bootstrapping settings to prevent the exposure of debug details, file paths, and stack traces.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/runtime-environment-hardening.md","path":"/downloads/php/laravel/v13-22-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When implementing custom authentication guards, credential providers, password reset methods, or request wrappers that handle raw passwords, tokens, or encryption keys.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/secret-handling.md","path":"/downloads/php/laravel/v13-22-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring HTTP middleware stack priorities and managing middleware exclusions in route groups or tests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/security-control-integrity.md","path":"/downloads/php/laravel/v13-22-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session storage settings, security flags, and encryption parameters in production applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/session-management.md","path":"/downloads/php/laravel/v13-22-0/session-management.md"}]}]},{"slug":"symfony","name":"Symfony","latestVersion":"v8-1-1","versions":[{"version":"v8.1.1","versionSlug":"v8-1-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/php/symfony/v8-1-1/","path":"/libraries/php/symfony/v8-1-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1.md","bundlePath":"/downloads/php/symfony/v8-1-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/0_security_blueprint.md","blueprintPath":"/downloads/php/symfony/v8-1-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When defining path rules, transport channels, HTTP methods, and access decision manager strategies in security configuration.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/access-control.md","path":"/downloads/php/symfony/v8-1-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When retrieving attributes from security tokens or evaluating authentication attributes in background workers and non-interactive contexts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/api-contract-misuse.md","path":"/downloads/php/symfony/v8-1-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Hardening authentication endpoints against brute-force attacks and account enumeration.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/authentication.md","path":"/downloads/php/symfony/v8-1-1/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Implementing HTTP kernel request event listeners, security filters, or failure handling middleware where untrusted inputs or sub-requests cross into trusted execution pipelines.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/boundary-control.md","path":"/downloads/php/symfony/v8-1-1/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"When hashing and verifying user credentials in Symfony applications to ensure proper cryptographic work factors and algorithms.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/cryptography.md","path":"/downloads/php/symfony/v8-1-1/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"When configuring framework CSRF protection, form login authentication, or validating custom state-changing requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/csrf.md","path":"/downloads/php/symfony/v8-1-1/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"Serving user-uploaded files and handling downloads via controller responses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/file-handling.md","path":"/downloads/php/symfony/v8-1-1/file-handling.md"},{"slug":"injection","title":"Injection","description":"When configuring custom LDAP user search queries with `LdapBadge` in Symfony security components to prevent LDAP injection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/injection.md","path":"/downloads/php/symfony/v8-1-1/injection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Handling authentication credentials and CSRF tokens from incoming HTTP requests to prevent type confusion or parameter tampering bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/input-interpretation-safety.md","path":"/downloads/php/symfony/v8-1-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring request handling and HTTP method overriding mechanisms in Symfony applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/interface-protocol-hardening.md","path":"/downloads/php/symfony/v8-1-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring the Symfony framework when running applications behind reverse proxies or load balancers to secure network boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/network-boundary.md","path":"/downloads/php/symfony/v8-1-1/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering the last authenticated username value derived from request or session input inside HTML templates to prevent Cross-Site Scripting.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/output-encoding.md","path":"/downloads/php/symfony/v8-1-1/output-encoding.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring Symfony application bundles and environment files for production deployment.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/runtime-environment-hardening.md","path":"/downloads/php/symfony/v8-1-1/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When configuring application secrets, managing decryption keys, and handling credentials in Symfony applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/secret-handling.md","path":"/downloads/php/symfony/v8-1-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Developing or configuring authentication components and firewall managers where mandatory security badges and credential verification rules must be strictly enforced without bypass.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/security-control-integrity.md","path":"/downloads/php/symfony/v8-1-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When configuring application security firewalls and framework session settings for user authentication and cookie attributes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/session-management.md","path":"/downloads/php/symfony/v8-1-1/session-management.md"}]}]}]},{"slug":"python","label":"Python","catalogUrl":"https://securitycards.rewarelabs.com/llms/python.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python.md","libraries":[{"slug":"aiohttp","name":"Aiohttp","latestVersion":"v3-14-3","versions":[{"version":"v3.14.3","versionSlug":"v3-14-3","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/aiohttp/v3-14-3/","path":"/libraries/python/aiohttp/v3-14-3/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3.md","bundlePath":"/downloads/python/aiohttp/v3-14-3.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/0_security_blueprint.md","blueprintPath":"/downloads/python/aiohttp/v3-14-3/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Implementing access control and header validation before accepting request bodies or acknowledging Expect: 100-continue requests in `aiohttp.web` applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/access-control.md","path":"/downloads/python/aiohttp/v3-14-3/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing asynchronous network applications or web services using aiohttp Web-Sockets where multiple tasks might interact with a single WebSocket stream.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/api-contract-misuse.md","path":"/downloads/python/aiohttp/v3-14-3/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When managing or filtering cookies within `aiohttp.ClientSession` or `CookieJar` to ensure boundary controls prevent cross-origin cookie leakage.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/boundary-control.md","path":"/downloads/python/aiohttp/v3-14-3/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring aiohttp client sessions where environment variables and netrc files should not dictate proxy routing or authentication credentials.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/configuration-source-integrity.md","path":"/downloads/python/aiohttp/v3-14-3/configuration-source-integrity.md"},{"slug":"deserialization","title":"Deserialization","description":"When loading cookie files into `aiohttp.CookieJar` where untrusted data could lead to arbitrary object construction via insecure pickling.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/deserialization.md","path":"/downloads/python/aiohttp/v3-14-3/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Handling file uploads from multipart requests and configuring static file routes in aiohttp web applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/file-handling.md","path":"/downloads/python/aiohttp/v3-14-3/file-handling.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Making asynchronous requests to target URLs provided by untrusted users using `session.get()`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/input-driven-boundary-selection.md","path":"/downloads/python/aiohttp/v3-14-3/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Processing incoming request paths, IP addresses, cookie parameters, and query strings where alternate, non-canonical, or encoded representations could bypass authorization or filtering checks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/input-interpretation-safety.md","path":"/downloads/python/aiohttp/v3-14-3/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Developing aiohttp web handlers that return `401 Unauthorized` responses and need to enforce protocol security policies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/interface-protocol-hardening.md","path":"/downloads/python/aiohttp/v3-14-3/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring request proxy settings, parsing proxy headers behind a reverse proxy, or managing cookie security origins in aiohttp.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/network-boundary.md","path":"/downloads/python/aiohttp/v3-14-3/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering dynamic user input or serving static files in `aiohttp` web applications to prevent browser-based script execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/output-encoding.md","path":"/downloads/python/aiohttp/v3-14-3/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Developing asynchronous HTTP clients with `aiohttp` to ensure remote endpoints and excessive inputs do not consume unbounded local resources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/resource-exhaustion.md","path":"/downloads/python/aiohttp/v3-14-3/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring aiohttp client sessions, event loops, and web servers for production deployment.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/runtime-environment-hardening.md","path":"/downloads/python/aiohttp/v3-14-3/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring client sessions, middleware, or requests requiring authentication credentials in `aiohttp` applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/secret-handling.md","path":"/downloads/python/aiohttp/v3-14-3/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When configuring and executing client requests with `aiohttp.ClientSession` where session-level middlewares handle critical security controls.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/security-control-integrity.md","path":"/downloads/python/aiohttp/v3-14-3/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Handling user logout or revoking an active user session in an aiohttp server application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/session-management.md","path":"/downloads/python/aiohttp/v3-14-3/session-management.md"}]}]},{"slug":"celery","name":"Celery","latestVersion":"v5-6-3","versions":[{"version":"v5.6.3","versionSlug":"v5-6-3","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/celery/v5-6-3/","path":"/libraries/python/celery/v5-6-3/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3.md","bundlePath":"/downloads/python/celery/v5-6-3.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/0_security_blueprint.md","blueprintPath":"/downloads/python/celery/v5-6-3/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When operators manage Celery workers, monitor task queues, or execute administrative commands like `celery purge` and `celery shell`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/access-control.md","path":"/downloads/python/celery/v5-6-3/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing workflows that construct, freeze, and asynchronously execute Celery signature instances.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/api-contract-misuse.md","path":"/downloads/python/celery/v5-6-3/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Setting up Celery connection URIs or transport options with external database and cache backends requiring authentication.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/authentication.md","path":"/downloads/python/celery/v5-6-3/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Instantiating dynamic, per-tenant Celery app instances to segregate broker URLs, virtual hosts, or result backends in multi-threaded environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/boundary-control.md","path":"/downloads/python/celery/v5-6-3/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring Celery message serialization, task signing, and public-key signature verification using RSA certificates and private keys.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/cryptography.md","path":"/downloads/python/celery/v5-6-3/cryptography.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Defining Celery tasks and handling incoming task message payloads that could otherwise lead to arbitrary code execution if dynamic callables are evaluated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/dangerous-execution.md","path":"/downloads/python/celery/v5-6-3/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"Configuring Celery workers, custom message consumers, and client applications to deserialize task messages and results securely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/deserialization.md","path":"/downloads/python/celery/v5-6-3/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Writing daemon process lock files or launching detached background Celery worker processes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/file-handling.md","path":"/downloads/python/celery/v5-6-3/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining and validating input parameters received from broker messages using Pydantic models in Celery tasks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/input-contract-definition.md","path":"/downloads/python/celery/v5-6-3/input-contract-definition.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"When converting task request contexts into task signatures during retries or manually forwarding message headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/interface-protocol-hardening.md","path":"/downloads/python/celery/v5-6-3/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring transport and result backend connections in Celery across network boundaries to prevent interception and unauthorized access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/network-boundary.md","path":"/downloads/python/celery/v5-6-3/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When defining tasks, configuring workers, and handling long-running or unbounded operations in Celery applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/resource-exhaustion.md","path":"/downloads/python/celery/v5-6-3/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring production runtime environments and process privileges for Celery background workers to minimize attack surface and prevent host compromise.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/runtime-environment-hardening.md","path":"/downloads/python/celery/v5-6-3/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring Celery message brokers, database result backends, or cloud storage connections.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/secret-handling.md","path":"/downloads/python/celery/v5-6-3/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When initializing certificate stores and loading security credentials for message signing or verification in Celery.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/celery/v5-6-3/security-control-integrity.md","path":"/downloads/python/celery/v5-6-3/security-control-integrity.md"}]}]},{"slug":"click","name":"Click","latestVersion":"8-4-2","versions":[{"version":"8.4.2","versionSlug":"8-4-2","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/click/8-4-2/","path":"/libraries/python/click/8-4-2/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2.md","bundlePath":"/downloads/python/click/8-4-2.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/0_security_blueprint.md","blueprintPath":"/downloads/python/click/8-4-2/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Building nested Click groups and subcommands that rely on `ctx.obj` for sharing application state across command hierarchies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/api-contract-misuse.md","path":"/downloads/python/click/8-4-2/api-contract-misuse.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Loading configuration files, default maps, and path parameters in Click CLI applications to prevent untrusted input from altering security behavior.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/configuration-source-integrity.md","path":"/downloads/python/click/8-4-2/configuration-source-integrity.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"When passing dynamic filenames, environment variables, or external command parameters to Click utilities like `click.edit()` or pager implementations that invoke external binaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/dangerous-execution.md","path":"/downloads/python/click/8-4-2/dangerous-execution.md"},{"slug":"file-handling","title":"File Handling","description":"Developing command-line interfaces that accept file paths or file objects as arguments or options and require strict validation of existence, permissions, and file types.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/file-handling.md","path":"/downloads/python/click/8-4-2/file-handling.md"},{"slug":"injection","title":"Injection","description":"When building command line interfaces with Click that forward unprocessed positional arguments or filenames to subprocesses or external editors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/injection.md","path":"/downloads/python/click/8-4-2/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining command-line parameters and options that require strict allowlists, explicit enumerations, or bounded numerical values.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/input-contract-definition.md","path":"/downloads/python/click/8-4-2/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing, converting, and validating untrusted command-line inputs or arguments to ensure they conform to expected formats and ranges before processing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/input-interpretation-safety.md","path":"/downloads/python/click/8-4-2/input-interpretation-safety.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"When deploying Click applications to automated or headless runtime environments that default to ASCII.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/runtime-environment-hardening.md","path":"/downloads/python/click/8-4-2/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Prompting command-line interface users for sensitive information such as passwords, tokens, or API keys.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/click/8-4-2/secret-handling.md","path":"/downloads/python/click/8-4-2/secret-handling.md"}]}]},{"slug":"cryptography","name":"Cryptography","latestVersion":"49-0-0","versions":[{"version":"49.0.0","versionSlug":"49-0-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/cryptography/49-0-0/","path":"/libraries/python/cryptography/49-0-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0.md","bundlePath":"/downloads/python/cryptography/49-0-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/0_security_blueprint.md","blueprintPath":"/downloads/python/cryptography/49-0-0/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When calling cryptographic primitives, encryption/decryption methods, key serialization, or integer-to-bytes conversions that require exact parameter types, correct argument counts, matching buffer si…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/api-contract-misuse.md","path":"/downloads/python/cryptography/49-0-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Verifying user passwords or credentials using password hashing and verification verifiers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/authentication.md","path":"/downloads/python/cryptography/49-0-0/authentication.md"},{"slug":"cryptography","title":"Cryptography","description":"Generating secure cryptographic keys, salts, and nonces for encryption, MACs, or key derivation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/cryptography.md","path":"/downloads/python/cryptography/49-0-0/cryptography.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Deserializing RSA private keys from user-supplied or untrusted input sources using serialization functions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/escape-hatch.md","path":"/downloads/python/cryptography/49-0-0/escape-hatch.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When constructing cryptographic primitives, key derivation functions, certificates, and tokens that require strict input validation, parameter bounds checking, type validation, and allowed value const…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/input-contract-definition.md","path":"/downloads/python/cryptography/49-0-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When loading untrusted asymmetric keys, signatures, certificates, CRLs, OCSP requests, or encoded points from external sources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/input-interpretation-safety.md","path":"/downloads/python/cryptography/49-0-0/input-interpretation-safety.md"},{"slug":"memory-safety","title":"Memory Safety","description":"Passing data buffers to `cryptography` methods where memory safety and data integrity must be maintained against concurrent modifications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/memory-safety.md","path":"/downloads/python/cryptography/49-0-0/memory-safety.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Encrypting or decrypting large data streams, files, or buffers using AEAD or Fernet primitives.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/resource-exhaustion.md","path":"/downloads/python/cryptography/49-0-0/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Serializing private keys, certificates, or handling sensitive secrets in storage or configuration.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/secret-handling.md","path":"/downloads/python/cryptography/49-0-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Implementing error handling for cryptographic verification functions such as token verification or AEAD decryption where failures must fail closed.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/security-control-integrity.md","path":"/downloads/python/cryptography/49-0-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When validating time-sensitive session state or transient session tokens using Fernet symmetric encryption.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/session-management.md","path":"/downloads/python/cryptography/49-0-0/session-management.md"}]}]},{"slug":"django","name":"Django","latestVersion":"6-0-7","versions":[{"version":"6.0.7","versionSlug":"6-0-7","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/django/6-0-7/","path":"/libraries/python/django/6-0-7/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7.md","bundlePath":"/downloads/python/django/6-0-7.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/0_security_blueprint.md","blueprintPath":"/downloads/python/django/6-0-7/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Protecting function-based views or class-based views to ensure only authenticated and authorized users can access specific functionality or resources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/access-control.md","path":"/downloads/python/django/6-0-7/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When configuring email messages with blind carbon copy recipients using `EmailMessage`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/api-contract-misuse.md","path":"/downloads/python/django/6-0-7/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When handling account recovery tokens, session authentication logins, and user verification workflows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/authentication.md","path":"/downloads/python/django/6-0-7/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Deploying Django behind a reverse proxy to handle secure connection transitions at the server boundary.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/boundary-control.md","path":"/downloads/python/django/6-0-7/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring password storage and handling user credentials securely in Django applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/cryptography.md","path":"/downloads/python/django/6-0-7/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Developing Django web applications that process state-changing requests and require cross-origin or standard form submission protection against cross-site request forgery.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/csrf.md","path":"/downloads/python/django/6-0-7/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"When configuring session serialization or handling signed objects and payloads to prevent unsafe arbitrary object construction and remote code execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/deserialization.md","path":"/downloads/python/django/6-0-7/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"When configuring file storage options to prevent user-controlled or colliding filenames from overwriting existing assets or data files.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/file-handling.md","path":"/downloads/python/django/6-0-7/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building database queries with Django QuerySets, raw SQL strings, or expression functions where untrusted user input is involved.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/injection.md","path":"/downloads/python/django/6-0-7/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When defining URL patterns, configuring path converters, implementing custom converters, or handling request host verification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/input-contract-definition.md","path":"/downloads/python/django/6-0-7/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Handling user-provided strings, handles, or registration data that require canonical representation and unambiguous interpretation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/input-interpretation-safety.md","path":"/downloads/python/django/6-0-7/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring transport security, MIME-sniffing protection, referrer policies, and cross-origin isolation headers for web applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/interface-protocol-hardening.md","path":"/downloads/python/django/6-0-7/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring Django's email backend to send messages securely over SMTP.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/network-boundary.md","path":"/downloads/python/django/6-0-7/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When rendering dynamic user input, constructing custom template tags or filters, or embedding data into HTML templates and attributes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/output-encoding.md","path":"/downloads/python/django/6-0-7/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When building forms, formsets, or handling request payloads that process untrusted user input.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/resource-exhaustion.md","path":"/downloads/python/django/6-0-7/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Preparing Django applications for production deployment and configuring runtime settings.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/runtime-environment-hardening.md","path":"/downloads/python/django/6-0-7/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring Django settings and application credentials in production or deployment environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/secret-handling.md","path":"/downloads/python/django/6-0-7/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring the `MIDDLEWARE` setting in Django applications where security controls depend on state established by upstream middleware.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/security-control-integrity.md","path":"/downloads/python/django/6-0-7/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session cookies and production settings to ensure cookies are transmitted securely and protected against interception or client-side extraction.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/django/6-0-7/session-management.md","path":"/downloads/python/django/6-0-7/session-management.md"}]}]},{"slug":"fastapi","name":"Fastapi","latestVersion":"0-139-2","versions":[{"version":"0.139.2","versionSlug":"0-139-2","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/fastapi/0-139-2/","path":"/libraries/python/fastapi/0-139-2/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2.md","bundlePath":"/downloads/python/fastapi/0-139-2.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/0_security_blueprint.md","blueprintPath":"/downloads/python/fastapi/0-139-2/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Use when adding `CORSMiddleware` to a FastAPI application to govern cross-origin browser requests and safely expose custom headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/access-control.md","path":"/downloads/python/fastapi/0-139-2/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Defining route handlers and specifying response serialization models for API endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/api-contract-misuse.md","path":"/downloads/python/fastapi/0-139-2/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Verifying user credentials, password hashes, or token signatures during authentication workflows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/authentication.md","path":"/downloads/python/fastapi/0-139-2/authentication.md"},{"slug":"cryptography","title":"Cryptography","description":"Implementing user registration and credential verification workflows in FastAPI applications requiring secure password hashing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/cryptography.md","path":"/downloads/python/fastapi/0-139-2/cryptography.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"A route accepts a formula, filter, rule, or other expression as text and computes a result from it.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/dangerous-execution.md","path":"/downloads/python/fastapi/0-139-2/dangerous-execution.md"},{"slug":"file-handling","title":"File Handling","description":"Developing FastAPI endpoints that handle multipart file uploads and need to prevent memory exhaustion and file descriptor leaks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/file-handling.md","path":"/downloads/python/fastapi/0-139-2/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building a SQL query where any part of the statement comes from a path parameter, query parameter, header, or request body.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/injection.md","path":"/downloads/python/fastapi/0-139-2/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Building FastAPI endpoints and validating incoming request parameters, query strings, headers, cookies, and form bodies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/input-contract-definition.md","path":"/downloads/python/fastapi/0-139-2/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Developing route handlers and request parsing where input content types and payload formats must be strictly validated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/input-interpretation-safety.md","path":"/downloads/python/fastapi/0-139-2/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Handling authentication failures in FastAPI application dependencies returning HTTP 401 Unauthorized responses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/interface-protocol-hardening.md","path":"/downloads/python/fastapi/0-139-2/interface-protocol-hardening.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Customizing interactive API documentation pages that render configuration dictionaries or parameters inside HTML script tags.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/output-encoding.md","path":"/downloads/python/fastapi/0-139-2/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Building FastAPI endpoints that accept request payloads and data bodies which might be leveraged by adversaries for denial of service via unbounded memory consumption.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/resource-exhaustion.md","path":"/downloads/python/fastapi/0-139-2/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring the production runtime environment for deployment to disable verbose error exposure and development-specific server settings.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/runtime-environment-hardening.md","path":"/downloads/python/fastapi/0-139-2/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring secret keys, API tokens, or cryptographic signing material for FastAPI applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/secret-handling.md","path":"/downloads/python/fastapi/0-139-2/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring security, logging, or rate-limiting middleware in a FastAPI application using `app.add_middleware()` or `@app.middleware()`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/security-control-integrity.md","path":"/downloads/python/fastapi/0-139-2/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Building stateless or stateful session authentication in FastAPI where session identifiers or tokens must be validated for expiration and lifetime constraints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/session-management.md","path":"/downloads/python/fastapi/0-139-2/session-management.md"}]}]},{"slug":"flask","name":"Flask","latestVersion":"3-1-3","versions":[{"version":"3.1.3","versionSlug":"3-1-3","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/flask/3-1-3/","path":"/libraries/python/flask/3-1-3/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3.md","bundlePath":"/downloads/python/flask/3-1-3.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/0_security_blueprint.md","blueprintPath":"/downloads/python/flask/3-1-3/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When building state-changing operations or resource modification routes in Flask where authenticated users perform updates or deletions on records.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/access-control.md","path":"/downloads/python/flask/3-1-3/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring application error handling, setting production flags, and registering custom error handlers or teardown hooks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/api-contract-misuse.md","path":"/downloads/python/flask/3-1-3/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Handling user registration and login requests to verify presented identity credentials before creating session variables or querying the database.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/authentication.md","path":"/downloads/python/flask/3-1-3/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Developing or configuring custom WSGI middleware, reverse proxy integrations, and application context routing boundaries in Flask applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/boundary-control.md","path":"/downloads/python/flask/3-1-3/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"When loading configuration and environment variables via `load_dotenv()` in Flask applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/configuration-source-integrity.md","path":"/downloads/python/flask/3-1-3/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"When registering new users, validating user login credentials, or persisting sensitive user data in the application database.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/cryptography.md","path":"/downloads/python/flask/3-1-3/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Developing state-changing routes and configuring session cookie policies in Flask applications to prevent cross-site request forgery.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/csrf.md","path":"/downloads/python/flask/3-1-3/csrf.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Configuring deployment settings and launching the application in a production environment, or evaluating an expression supplied by a request.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/dangerous-execution.md","path":"/downloads/python/flask/3-1-3/dangerous-execution.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Rendering trusted field widget calls within template macros where HTML structure must be preserved, or displaying HTML that was authored by a user and stored by the application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/escape-hatch.md","path":"/downloads/python/flask/3-1-3/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"Handling file uploads from users or serving requested files from the filesystem.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/file-handling.md","path":"/downloads/python/flask/3-1-3/file-handling.md"},{"slug":"injection","title":"Injection","description":"Writing database queries with dynamic user input, or recording user-controlled values in application logs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/injection.md","path":"/downloads/python/flask/3-1-3/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Handling incoming HTTP request form data or query parameters that require structural and type validation before executing business logic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/input-contract-definition.md","path":"/downloads/python/flask/3-1-3/input-contract-definition.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Developing response processors, custom session interfaces, or after-request hooks in Flask to harden network protocol semantics and enforce browser security controls.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/interface-protocol-hardening.md","path":"/downloads/python/flask/3-1-3/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring network trust boundaries and verifying remote IP addresses or proxy configurations in Flask applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/network-boundary.md","path":"/downloads/python/flask/3-1-3/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering manual HTML strings or dynamic user-controlled data within HTML templates and attributes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/output-encoding.md","path":"/downloads/python/flask/3-1-3/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring Flask application settings to restrict incoming payload sizes and multipart form parsing consumption.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/resource-exhaustion.md","path":"/downloads/python/flask/3-1-3/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Deploying the Flask application to a live production environment rather than running it locally for development.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/runtime-environment-hardening.md","path":"/downloads/python/flask/3-1-3/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring Flask application secrets and setting up secure credential management for session signing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/secret-handling.md","path":"/downloads/python/flask/3-1-3/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Testing request-dependent code using `app.test_request_context()` where tests depend on security controls or identity population configured inside `before_request` hooks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/security-control-integrity.md","path":"/downloads/python/flask/3-1-3/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session cookie security attributes, managing session lifetimes, and clearing or updating session data during user login, logout, and state modifications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/session-management.md","path":"/downloads/python/flask/3-1-3/session-management.md"}]}]},{"slug":"httpx","name":"Httpx","latestVersion":"0-28-1","versions":[{"version":"0.28.1","versionSlug":"0-28-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/httpx/0-28-1/","path":"/libraries/python/httpx/0-28-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1.md","bundlePath":"/downloads/python/httpx/0-28-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/0_security_blueprint.md","blueprintPath":"/downloads/python/httpx/0-28-1/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing custom authentication flows by subclassing `httpx.Auth` that inspect request or response content.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/api-contract-misuse.md","path":"/downloads/python/httpx/0-28-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When establishing client authentication, passing credentials, or implementing custom authentication handlers in HTTPX.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/authentication.md","path":"/downloads/python/httpx/0-28-1/authentication.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Instantiating an `httpx.Client` or `httpx.AsyncClient` in multi-tenant or untrusted environments where ambient environment variables may be manipulated by external actors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/configuration-source-integrity.md","path":"/downloads/python/httpx/0-28-1/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring client certificate validation, custom CA bundles, or connecting over HTTPS using HTTPX.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/cryptography.md","path":"/downloads/python/httpx/0-28-1/cryptography.md"},{"slug":"injection","title":"Injection","description":"Constructing HTTP requests from untrusted user input that may contain control characters or malformed syntax.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/injection.md","path":"/downloads/python/httpx/0-28-1/injection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When processing external or untrusted URL strings to prevent parser differentials and invalid input interpretations before executing HTTP requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/input-interpretation-safety.md","path":"/downloads/python/httpx/0-28-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring HTTPX clients to handle connection failures and transient network timeouts safely using transport-level retries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/interface-protocol-hardening.md","path":"/downloads/python/httpx/0-28-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Making HTTP requests where automatic redirects might cross network boundaries or expose sensitive credentials to untrusted origins.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/network-boundary.md","path":"/downloads/python/httpx/0-28-1/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When building HTTP client requests and managing connection transports to prevent thread starvation and resource exhaustion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/resource-exhaustion.md","path":"/downloads/python/httpx/0-28-1/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When developers configure client instances with default headers or custom authentication properties, or manage redirection behaviors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/secret-handling.md","path":"/downloads/python/httpx/0-28-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When registering response event hooks on an HTTPX client to consistently enforce status code checking across all operations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/security-control-integrity.md","path":"/downloads/python/httpx/0-28-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Managing session state and cookie persistence across requests when using `httpx.Client`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/session-management.md","path":"/downloads/python/httpx/0-28-1/session-management.md"}]}]},{"slug":"jinja","name":"Jinja","latestVersion":"3-1-6","versions":[{"version":"3.1.6","versionSlug":"3-1-6","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/jinja/3-1-6/","path":"/libraries/python/jinja/3-1-6/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6.md","bundlePath":"/downloads/python/jinja/3-1-6.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/0_security_blueprint.md","blueprintPath":"/downloads/python/jinja/3-1-6/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When rendering untrusted user-supplied templates or exposing Python objects and functions to templates where unauthorized actions, side effects, or cross-boundary data access must be prevented.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/access-control.md","path":"/downloads/python/jinja/3-1-6/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When creating custom Jinja extensions that need to manage state or configuration across templates.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/api-contract-misuse.md","path":"/downloads/python/jinja/3-1-6/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Rendering untrusted templates where data structures and application state must be protected against modification during execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/boundary-control.md","path":"/downloads/python/jinja/3-1-6/boundary-control.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Configuring Jinja environment extensions or resolving dynamic helper strings that use `import_string` or extension loading mechanisms.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/dangerous-execution.md","path":"/downloads/python/jinja/3-1-6/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"Configuring Jinja bytecode caches or handling serialized Environment instances where untrusted data or insecure deserialization could lead to arbitrary code execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/deserialization.md","path":"/downloads/python/jinja/3-1-6/deserialization.md"},{"slug":"injection","title":"Injection","description":"Rendering dynamic HTML or XML attributes using the `xmlattr` filter in templates to prevent attribute injection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/injection.md","path":"/downloads/python/jinja/3-1-6/injection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When templates contain literal Jinja delimiters or front-end framework placeholders that should be interpreted strictly as literal text rather than being parsed and executed.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/input-interpretation-safety.md","path":"/downloads/python/jinja/3-1-6/input-interpretation-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When rendering dynamic templates or handling untrusted user input within HTML and internationalization contexts to prevent cross-site scripting.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/output-encoding.md","path":"/downloads/python/jinja/3-1-6/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Rendering untrusted templates where attackers might trigger excessive CPU or memory consumption using large ranges or expensive operators.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/resource-exhaustion.md","path":"/downloads/python/jinja/3-1-6/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring Jinja environments in production to restrict runtime behavior and disable unsafe debugging output.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/runtime-environment-hardening.md","path":"/downloads/python/jinja/3-1-6/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring Jinja environments in Python applications where sensitive variables or environment settings might be inadvertently exposed in production.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/secret-handling.md","path":"/downloads/python/jinja/3-1-6/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When rendering templates that process untrusted input or use string formatting expressions that could potentially traverse object graphs and bypass standard security checks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/security-control-integrity.md","path":"/downloads/python/jinja/3-1-6/security-control-integrity.md"}]}]},{"slug":"langchain","name":"Langchain","latestVersion":"langchain-1-3-14","versions":[{"version":"langchain.1.3.14","versionSlug":"langchain-1-3-14","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/langchain/langchain-1-3-14/","path":"/libraries/python/langchain/langchain-1-3-14/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14.md","bundlePath":"/downloads/python/langchain/langchain-1-3-14.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/0_security_blueprint.md","blueprintPath":"/downloads/python/langchain/langchain-1-3-14/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring human-in-the-loop validation or access control boundaries for agent tool executions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/access-control.md","path":"/downloads/python/langchain/langchain-1-3-14/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When initializing or configuring LangChain models, text splitters, tool bindings, and middleware components that enforce strict argument types, value ranges, and compatibility requirements.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/api-contract-misuse.md","path":"/downloads/python/langchain/langchain-1-3-14/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Configuring chat models and authentication providers that require dynamic tokens instead of static API keys or unverified claims.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/authentication.md","path":"/downloads/python/langchain/langchain-1-3-14/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When configuring Anthropic agent tool middleware such as state-based file or memory tool operations where untrusted model input dictates paths that cross application boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/boundary-control.md","path":"/downloads/python/langchain/langchain-1-3-14/boundary-control.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Configuring execution environments for shell tool middleware and parsing prompt templates with string formatters or dynamic environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/dangerous-execution.md","path":"/downloads/python/langchain/langchain-1-3-14/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"Deserializing untrusted payloads or manifests in LangChain workflows where arbitrary object instantiation must be prevented.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/deserialization.md","path":"/downloads/python/langchain/langchain-1-3-14/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring file search middleware or processing file patch tool operations in agentic workflows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/file-handling.md","path":"/downloads/python/langchain/langchain-1-3-14/file-handling.md"},{"slug":"injection","title":"Injection","description":"Formatting sequences of messages that include untrusted user input into conversation strings for model prompts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/injection.md","path":"/downloads/python/langchain/langchain-1-3-14/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Building tools and Runnable chains that process external user inputs or dynamic model calls in LangChain","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/input-contract-definition.md","path":"/downloads/python/langchain/langchain-1-3-14/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When configuring fallback models or routing specifications that instantiate models dynamically from string identifiers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/input-driven-boundary-selection.md","path":"/downloads/python/langchain/langchain-1-3-14/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When processing tool call arguments and structured model outputs returned by chat models to prevent malformed or unvalidated payloads from reaching downstream tools.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/input-interpretation-safety.md","path":"/downloads/python/langchain/langchain-1-3-14/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring service endpoints and base URLs for client connections to prevent protocol smuggling or unsupported protocol handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/interface-protocol-hardening.md","path":"/downloads/python/langchain/langchain-1-3-14/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Making outbound HTTP requests, processing dynamic or user-provided URLs in agent tools, or configuring chat model connections in LangChain.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/network-boundary.md","path":"/downloads/python/langchain/langchain-1-3-14/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When building agents and LLM-powered applications using LangChain where operations, model calls, tools, or shell commands could consume unbounded system resources, memory, or time.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/resource-exhaustion.md","path":"/downloads/python/langchain/langchain-1-3-14/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring container execution policies and runtime privileges when running shell tools.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/runtime-environment-hardening.md","path":"/downloads/python/langchain/langchain-1-3-14/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When instantiating model wrappers, clients, and providers in LangChain, or loading secrets from configuration sources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/secret-handling.md","path":"/downloads/python/langchain/langchain-1-3-14/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When trimming chat history sequences or managing context windows in language model interactions where security instructions or guardrails must not be dropped.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/security-control-integrity.md","path":"/downloads/python/langchain/langchain-1-3-14/security-control-integrity.md"}]}]},{"slug":"llama-index","name":"Llama Index","latestVersion":"v0-14-23","versions":[{"version":"v0.14.23","versionSlug":"v0-14-23","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/llama-index/v0-14-23/","path":"/libraries/python/llama-index/v0-14-23/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23.md","bundlePath":"/downloads/python/llama-index/v0-14-23.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/0_security_blueprint.md","blueprintPath":"/downloads/python/llama-index/v0-14-23/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When building retrieval-augmented generation apps or chat storage workflows that load indexes, vectors, or chat histories based on user-supplied parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/access-control.md","path":"/downloads/python/llama-index/v0-14-23/access-control.md"},{"slug":"authentication","title":"Authentication","description":"Integrating LlamaIndex with cloud services, vector stores, and readers where identity and credentials must be established via tokens, service accounts, or managed identities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/authentication.md","path":"/downloads/python/llama-index/v0-14-23/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Integrating guardrails, scanners, or server-side safety filters to validate user prompts and inspect LLM outputs when processing queries in multimodal RAG applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/boundary-control.md","path":"/downloads/python/llama-index/v0-14-23/boundary-control.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Configuring model loaders and initializers where custom scripts or remote execution mechanisms might be enabled.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/dangerous-execution.md","path":"/downloads/python/llama-index/v0-14-23/dangerous-execution.md"},{"slug":"file-handling","title":"File Handling","description":"When accepting local file paths or destination paths from user input or remote tools that interact with the local filesystem, code interpreter downloads, or document parsing blocks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/file-handling.md","path":"/downloads/python/llama-index/v0-14-23/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building database readers, executing queries, or configuring chat stores with dynamic database parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/injection.md","path":"/downloads/python/llama-index/v0-14-23/injection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Passing prompt templates or completion strings containing literal curly braces or untrusted user input to LLM completion methods.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/input-interpretation-safety.md","path":"/downloads/python/llama-index/v0-14-23/input-interpretation-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring LLMs, vector stores, and external data connectors that establish outbound network connections over HTTPS or TLS.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/network-boundary.md","path":"/downloads/python/llama-index/v0-14-23/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Handling raw user-supplied strings or inputs before submitting them to ingestion pipelines or query components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/resource-exhaustion.md","path":"/downloads/python/llama-index/v0-14-23/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring Elasticsearch vector store backends in production environments for LlamaIndex applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/runtime-environment-hardening.md","path":"/downloads/python/llama-index/v0-14-23/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Instantiating cloud tools and readers that acquire and store OAuth access and refresh tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/secret-handling.md","path":"/downloads/python/llama-index/v0-14-23/secret-handling.md"},{"slug":"session-management","title":"Session Management","description":"Developing multi-tenant applications using LlamaIndex chat memory or tool specifications where distinct user sessions must be isolated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/session-management.md","path":"/downloads/python/llama-index/v0-14-23/session-management.md"}]}]},{"slug":"pydantic","name":"Pydantic","latestVersion":"v2-13-4","versions":[{"version":"v2.13.4","versionSlug":"v2-13-4","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/pydantic/v2-13-4/","path":"/libraries/python/pydantic/v2-13-4/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4.md","bundlePath":"/downloads/python/pydantic/v2-13-4.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/0_security_blueprint.md","blueprintPath":"/downloads/python/pydantic/v2-13-4/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When defining Pydantic models for external APIs and handling field aliases or serialization formats to prevent API contract violations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/api-contract-misuse.md","path":"/downloads/python/pydantic/v2-13-4/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Parsing untrusted external input payloads or configuration data at application boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/boundary-control.md","path":"/downloads/python/pydantic/v2-13-4/boundary-control.md"},{"slug":"deserialization","title":"Deserialization","description":"When validating YAML data files with Pydantic models to prevent arbitrary object instantiation and code execution before schema validation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/deserialization.md","path":"/downloads/python/pydantic/v2-13-4/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Processing untrusted input data or working with low-level Pydantic methods that bypass normal runtime schema validation, type checking, and field constraints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/escape-hatch.md","path":"/downloads/python/pydantic/v2-13-4/escape-hatch.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Use when designing and validating incoming API requests, external file payloads, or untrusted data models to ensure inputs adhere strictly to defined types, ranges, lengths, and extra field restrictio…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/input-contract-definition.md","path":"/downloads/python/pydantic/v2-13-4/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When validating external or untrusted input payloads where automatic type coercion could alter expected data structures or bypass input verification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/input-interpretation-safety.md","path":"/downloads/python/pydantic/v2-13-4/input-interpretation-safety.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When defining Pydantic models or `pydantic_core` schemas for collections, strings, bytes, and URLs supplied by external or untrusted users.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/resource-exhaustion.md","path":"/downloads/python/pydantic/v2-13-4/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Defining Pydantic models that process or store sensitive data like API keys, passwords, tokens, or personal information.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/secret-handling.md","path":"/downloads/python/pydantic/v2-13-4/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Defining Pydantic dataclasses or utilizing internal dataclass construction where attribute mutation or validation suppression could bypass security invariants.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/security-control-integrity.md","path":"/downloads/python/pydantic/v2-13-4/security-control-integrity.md"}]}]},{"slug":"pyjwt","name":"Pyjwt","latestVersion":"2-13-0","versions":[{"version":"2.13.0","versionSlug":"2-13-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/pyjwt/2-13-0/","path":"/libraries/python/pyjwt/2-13-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0.md","bundlePath":"/downloads/python/pyjwt/2-13-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/0_security_blueprint.md","blueprintPath":"/downloads/python/pyjwt/2-13-0/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Calling `jwt.get_unverified_header()` or `PyJWKClient.get_signing_key_from_jwt()` to inspect header metadata or retrieve a signing key before processing a JSON Web Token.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/api-contract-misuse.md","path":"/downloads/python/pyjwt/2-13-0/api-contract-misuse.md"},{"slug":"cryptography","title":"Cryptography","description":"Verifying cryptographic signatures and handling key parameters during token processing","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/cryptography.md","path":"/downloads/python/pyjwt/2-13-0/cryptography.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When validating incoming JSON Web Tokens using jwt.decode to ensure essential payload claims are present.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/input-contract-definition.md","path":"/downloads/python/pyjwt/2-13-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing or configuring cryptographic keys from external JSON representations during token verification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/input-interpretation-safety.md","path":"/downloads/python/pyjwt/2-13-0/input-interpretation-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Instantiating `PyJWKClient` to fetch remote JSON Web Key Sets for token verification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/network-boundary.md","path":"/downloads/python/pyjwt/2-13-0/network-boundary.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring the production runtime and deployment environment to support asymmetric token verification via `PyJWK` or `PyJWKSet`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/runtime-environment-hardening.md","path":"/downloads/python/pyjwt/2-13-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When loading secret keys and configuring authentication parameters prior to token signing or verification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/secret-handling.md","path":"/downloads/python/pyjwt/2-13-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Decoding and verifying JSON Web Tokens where validation errors must result in explicit authentication rejections rather than unhandled exceptions or bypassed controls.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/security-control-integrity.md","path":"/downloads/python/pyjwt/2-13-0/security-control-integrity.md"}]}]},{"slug":"pyyaml","name":"Pyyaml","latestVersion":"6-0-3","versions":[{"version":"6.0.3","versionSlug":"6-0-3","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/pyyaml/6-0-3/","path":"/libraries/python/pyyaml/6-0-3/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3.md","bundlePath":"/downloads/python/pyyaml/6-0-3.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/0_security_blueprint.md","blueprintPath":"/downloads/python/pyyaml/6-0-3/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When managing direct serializer lifecycles to emit YAML events from AST nodes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/api-contract-misuse.md","path":"/downloads/python/pyyaml/6-0-3/api-contract-misuse.md"},{"slug":"deserialization","title":"Deserialization","description":"Parsing untrusted YAML configuration files or defining custom loader classes and path resolvers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/deserialization.md","path":"/downloads/python/pyyaml/6-0-3/deserialization.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When parsing untrusted YAML input streams that are expected to contain exactly one document structure.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/input-contract-definition.md","path":"/downloads/python/pyyaml/6-0-3/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When parsing untrusted YAML data streams, byte sequences, or configuration files in Python applications using PyYAML.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/input-interpretation-safety.md","path":"/downloads/python/pyyaml/6-0-3/input-interpretation-safety.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Parsing untrusted YAML documents using PyYAML to prevent resource exhaustion from deeply nested structures.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/resource-exhaustion.md","path":"/downloads/python/pyyaml/6-0-3/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Catching parsing errors when processing YAML documents containing secrets, credentials, or sensitive path names.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/secret-handling.md","path":"/downloads/python/pyyaml/6-0-3/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Registering custom tag constructors for YAML parsing where security controls like `yaml.safe_load` must remain consistently applied and enabled across execution paths.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/security-control-integrity.md","path":"/downloads/python/pyyaml/6-0-3/security-control-integrity.md"}]}]},{"slug":"requests","name":"Requests","latestVersion":"v2-34-2","versions":[{"version":"v2.34.2","versionSlug":"v2-34-2","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/requests/v2-34-2/","path":"/libraries/python/requests/v2-34-2/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2.md","bundlePath":"/downloads/python/requests/v2-34-2.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/0_security_blueprint.md","blueprintPath":"/downloads/python/requests/v2-34-2/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Processing response data or parsing payloads returned from HTTP requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/api-contract-misuse.md","path":"/downloads/python/requests/v2-34-2/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Establishing and verifying identity using credentials, tokens, or digest authentication when sending HTTP requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/authentication.md","path":"/downloads/python/requests/v2-34-2/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When accepting dynamic or user-supplied target URL strings before passing them to requests functions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/boundary-control.md","path":"/downloads/python/requests/v2-34-2/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring HTTP sessions in multi-tenant, serverless, or untrusted environments where local environment variables or .netrc files could be manipulated by external actors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/configuration-source-integrity.md","path":"/downloads/python/requests/v2-34-2/configuration-source-integrity.md"},{"slug":"file-handling","title":"File Handling","description":"Writing or updating files on disk to prevent race conditions or partially written data exposure.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/file-handling.md","path":"/downloads/python/requests/v2-34-2/file-handling.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Serializing data structures to JSON payloads via the `json` parameter in requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/input-interpretation-safety.md","path":"/downloads/python/requests/v2-34-2/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"When handling HTTP responses from external servers and parsing message framing and headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/interface-protocol-hardening.md","path":"/downloads/python/requests/v2-34-2/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring trusted proxy environments and destination bypass rules for outbound requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/network-boundary.md","path":"/downloads/python/requests/v2-34-2/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Making HTTP requests using the requests library where unmanaged streams or missing timeouts can lead to connection exhaustion and thread blocking.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/resource-exhaustion.md","path":"/downloads/python/requests/v2-34-2/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring requests with client certificates, basic authentication, netrc files, or handling ephemeral tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/secret-handling.md","path":"/downloads/python/requests/v2-34-2/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Building requests manually using `PreparedRequest` and sending them with `Session.send()` where system trust stores and environment configurations must be applied.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/security-control-integrity.md","path":"/downloads/python/requests/v2-34-2/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Creating custom cookies programmatically or adding them to a RequestsCookieJar for session management.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/session-management.md","path":"/downloads/python/requests/v2-34-2/session-management.md"}]}]},{"slug":"sglang","name":"Sglang","latestVersion":"v0-5-16","versions":[{"version":"v0.5.16","versionSlug":"v0-5-16","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/sglang/v0-5-16/","path":"/libraries/python/sglang/v0-5-16/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16.md","bundlePath":"/downloads/python/sglang/v0-5-16.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/0_security_blueprint.md","blueprintPath":"/downloads/python/sglang/v0-5-16/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring SGLang server deployments and routing layers that expose management, worker registration, tokenizers, cache flushing, or runtime model update APIs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/access-control.md","path":"/downloads/python/sglang/v0-5-16/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring structured generation requests with constraints such as json_schema, regex, or ebnf.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/api-contract-misuse.md","path":"/downloads/python/sglang/v0-5-16/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When launching SGLang model gateways, routers, or OpenAI-compatible server instances that require API key verification on incoming requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/authentication.md","path":"/downloads/python/sglang/v0-5-16/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Deploying SGLang with multimodal models and configuring `mm_feature_transport`","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/boundary-control.md","path":"/downloads/python/sglang/v0-5-16/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring server parameters or implementing custom model overrides during SGLang initialization and runtime updates.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/configuration-source-integrity.md","path":"/downloads/python/sglang/v0-5-16/configuration-source-integrity.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"When configuring SGLang server arguments or handling incoming request parameters that could load custom models or execute dynamic processors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/dangerous-execution.md","path":"/downloads/python/sglang/v0-5-16/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"Configuring SGLang engine IPC ports, distributed disaggregation endpoints, and generation request inputs that rely on pickle deserialization or custom processors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/deserialization.md","path":"/downloads/python/sglang/v0-5-16/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Handling user-influenced file paths, log archives, and storage directories in SGLang applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/file-handling.md","path":"/downloads/python/sglang/v0-5-16/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When developers construct request objects, parse incoming client payloads, or configure model generation and chat parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/input-contract-definition.md","path":"/downloads/python/sglang/v0-5-16/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When accepting client-provided model strings or adapter specifications in OpenAI-compatible serving interfaces.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/input-driven-boundary-selection.md","path":"/downloads/python/sglang/v0-5-16/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing, decoding, or interpreting incoming request payloads, chat completions, and model-generated tool call arguments from untrusted clients.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/input-interpretation-safety.md","path":"/downloads/python/sglang/v0-5-16/input-interpretation-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Deploying the SGLang model gateway, router, or worker services in production environments where network trust boundaries must be enforced.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/network-boundary.md","path":"/downloads/python/sglang/v0-5-16/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When initializing gateways, routers, and server configurations to handle untrusted incoming inference traffic safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/resource-exhaustion.md","path":"/downloads/python/sglang/v0-5-16/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring deployment manifests and security contexts for Sglang worker and leader containers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/runtime-environment-hardening.md","path":"/downloads/python/sglang/v0-5-16/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When configuring gateways, database connections, API keys, and external service integrations in SGLang.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/secret-handling.md","path":"/downloads/python/sglang/v0-5-16/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Building router configurations and restoring persisted workflow states for the model gateway.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/security-control-integrity.md","path":"/downloads/python/sglang/v0-5-16/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Managing multi-turn streaming sessions and cleaning up idle or failed request states in SGLang session controllers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sglang/v0-5-16/session-management.md","path":"/downloads/python/sglang/v0-5-16/session-management.md"}]}]},{"slug":"sqlalchemy","name":"Sqlalchemy","latestVersion":"rel-2-0-51","versions":[{"version":"rel.2.0.51","versionSlug":"rel-2-0-51","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/sqlalchemy/rel-2-0-51/","path":"/libraries/python/sqlalchemy/rel-2-0-51/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51.md","bundlePath":"/downloads/python/sqlalchemy/rel-2-0-51.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/0_security_blueprint.md","blueprintPath":"/downloads/python/sqlalchemy/rel-2-0-51/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Enforcing tenant isolation or row-level access control on database queries using SQLAlchemy ORM relationship loader options.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/access-control.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When executing queries with joined collection relationships or server-side cursors where specific result processing methods and execution options are mandated by the API contract.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/api-contract-misuse.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Connecting to Microsoft SQL Server or Azure SQL Database using dynamic Azure Active Directory access tokens via SQLAlchemy event listeners.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/authentication.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Reflecting database metadata or defining table schemas against PostgreSQL databases where search_path configurations or schema names may lead to schema shadowing and unintended data access boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/boundary-control.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring database engines with database-specific dialects like Oracle where dynamic introspection can alter critical configuration behavior.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/configuration-source-integrity.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring database connection URLs with extensions like SQLCipher where encryption settings and key derivation iteration counts must be explicitly specified.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/cryptography.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/cryptography.md"},{"slug":"deserialization","title":"Deserialization","description":"Deserializing data streams, query states, ORM objects, or result rows from untrusted sources or network endpoints where arbitrary code execution must be prevented.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/deserialization.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Rendering raw SQL fragments using low-level escape hatch mechanisms like text() or literal_column() within SQLAlchemy Core or ORM queries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/escape-hatch.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/escape-hatch.md"},{"slug":"injection","title":"Injection","description":"When executing queries, building DML statements, or filtering database entities using SQLAlchemy Core, ORM, or textual SQL.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/injection.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Implementing custom mutable scalar or composite types with `Mutable` or `MutableComposite` in SQLAlchemy ORM models where incoming assignments require structural type validation and rejection of unexp…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/input-contract-definition.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When using `ShardedSession` to execute persistence and query operations across multiple database instances.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/input-driven-boundary-selection.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When constructing database connection URLs dynamically using credentials or components containing special characters to prevent parsing and component boundary misinterpretation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/input-interpretation-safety.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/input-interpretation-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Constructing SQLAlchemy database connection URLs when database endpoints must remain within fixed network boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/network-boundary.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Streaming or querying large datasets in SQLAlchemy to prevent memory exhaustion and database connection degradation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/resource-exhaustion.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring database connection strings, engine URLs, and cryptographic parameters requiring sensitive credentials or passphrases.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/secret-handling.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When building cached SQL statements using `lambda_stmt` or adding criteria that involve conditional branching or tenant isolation filters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/security-control-integrity.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When managing database sessions and connection scopes across multi-threaded or asynchronous application requests and task handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/session-management.md","path":"/downloads/python/sqlalchemy/rel-2-0-51/session-management.md"}]}]},{"slug":"starlette","name":"Starlette","latestVersion":"1-3-1","versions":[{"version":"1.3.1","versionSlug":"1-3-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/starlette/1-3-1/","path":"/libraries/python/starlette/1-3-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1.md","bundlePath":"/downloads/python/starlette/1-3-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/0_security_blueprint.md","blueprintPath":"/downloads/python/starlette/1-3-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When building HTTP endpoints or WebSocket handlers in Starlette that require permission checks, role checks, or authentication state enforcement.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/access-control.md","path":"/downloads/python/starlette/1-3-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When handling HTTP requests in Starlette and needing to read the request data as both a stream and a full body.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/api-contract-misuse.md","path":"/downloads/python/starlette/1-3-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When building custom authentication backends in Starlette to establish and verify user identity from request headers or credentials.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/authentication.md","path":"/downloads/python/starlette/1-3-1/authentication.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Accessing and managing environment variables programmatically during application setup or initialization to prevent runtime mutation and configuration inconsistency.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/configuration-source-integrity.md","path":"/downloads/python/starlette/1-3-1/configuration-source-integrity.md"},{"slug":"csrf","title":"CSRF","description":"Configuring session handling in Starlette applications to protect state-changing requests from cross-site request forgery.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/csrf.md","path":"/downloads/python/starlette/1-3-1/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"Handling user-influenced file paths when serving files via `FileResponse`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/file-handling.md","path":"/downloads/python/starlette/1-3-1/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining URL route patterns and path parameters in Starlette to ensure malformed inputs are rejected before reaching endpoint handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/input-contract-definition.md","path":"/downloads/python/starlette/1-3-1/input-contract-definition.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring Starlette CORSMiddleware security headers to restrict cross-origin access, handle credentials securely, and control private network access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/interface-protocol-hardening.md","path":"/downloads/python/starlette/1-3-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring access controls, rate limits, or security middleware that depend on client IP addresses and network trust boundaries behind reverse proxies.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/network-boundary.md","path":"/downloads/python/starlette/1-3-1/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering dynamic user input into HTML templates using Starlette templates and a custom `jinja2.Environment`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/output-encoding.md","path":"/downloads/python/starlette/1-3-1/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Handling incoming HTTP requests, JSON payloads, or multipart/form-data uploads in Starlette endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/resource-exhaustion.md","path":"/downloads/python/starlette/1-3-1/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring production environments when instantiating `ServerErrorMiddleware` or configuring Starlette applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/runtime-environment-hardening.md","path":"/downloads/python/starlette/1-3-1/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When loading session keys, application secrets, or sensitive configuration values into Starlette middleware or components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/secret-handling.md","path":"/downloads/python/starlette/1-3-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When managing authentication states, audit metadata, or security context across middleware boundaries and endpoint handlers in Starlette.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/security-control-integrity.md","path":"/downloads/python/starlette/1-3-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session state handling and cookie attributes for Starlette applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/session-management.md","path":"/downloads/python/starlette/1-3-1/session-management.md"}]}]},{"slug":"urllib3","name":"Urllib3","latestVersion":"2-7-0","versions":[{"version":"2.7.0","versionSlug":"2-7-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/urllib3/2-7-0/","path":"/libraries/python/urllib3/2-7-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0.md","bundlePath":"/downloads/python/urllib3/2-7-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/0_security_blueprint.md","blueprintPath":"/downloads/python/urllib3/2-7-0/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Handling connection errors and exception attributes when interacting with remote services using urllib3.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/api-contract-misuse.md","path":"/downloads/python/urllib3/2-7-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Establishing mutual TLS client identity verification using client certificates, private keys, and certificate authorities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/authentication.md","path":"/downloads/python/urllib3/2-7-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Validating untrusted URLs or enforcing host allowlists at a system boundary before passing state to trusted logic or network clients.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/boundary-control.md","path":"/downloads/python/urllib3/2-7-0/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"When pinning server certificates to validate peer identity and prevent timing side-channel attacks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/cryptography.md","path":"/downloads/python/urllib3/2-7-0/cryptography.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When validating untrusted input string URLs and enforcing strict port boundaries before passing them to networking components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/input-contract-definition.md","path":"/downloads/python/urllib3/2-7-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Constructing URLs with user-supplied components or parsing hostnames and parameters in urllib3","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/input-interpretation-safety.md","path":"/downloads/python/urllib3/2-7-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Making HTTP requests and defining custom method names using urllib3","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/interface-protocol-hardening.md","path":"/downloads/python/urllib3/2-7-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring outbound connections through proxy managers or SOCKS proxies where transport security and endpoint reachability must be protected across network boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/network-boundary.md","path":"/downloads/python/urllib3/2-7-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Making HTTP requests when you need to prevent threads or processes from hanging indefinitely due to slow or unresponsive servers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/resource-exhaustion.md","path":"/downloads/python/urllib3/2-7-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring the production runtime environment and container base images for deploying applications using urllib3.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/runtime-environment-hardening.md","path":"/downloads/python/urllib3/2-7-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring connection retry behaviors and making HTTP requests where custom API keys or authentication tokens may be exposed during cross-host redirects.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/secret-handling.md","path":"/downloads/python/urllib3/2-7-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring warning management and logging for HTTP request execution where security controls and transport alerts must remain active.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/security-control-integrity.md","path":"/downloads/python/urllib3/2-7-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Handling session cookies returned in urllib3 HTTP responses to ensure security attributes like HttpOnly and path restrictions are properly interpreted.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/session-management.md","path":"/downloads/python/urllib3/2-7-0/session-management.md"}]}]},{"slug":"vllm","name":"Vllm","latestVersion":"v0-26-0","versions":[{"version":"v0.26.0","versionSlug":"v0-26-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/python/vllm/v0-26-0/","path":"/libraries/python/vllm/v0-26-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0.md","bundlePath":"/downloads/python/vllm/v0-26-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/0_security_blueprint.md","blueprintPath":"/downloads/python/vllm/v0-26-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring file access and cross-origin resource sharing for model inputs and server endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/access-control.md","path":"/downloads/python/vllm/v0-26-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Applying chat templates and configuring tokenization or request parameters for language model inference.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/api-contract-misuse.md","path":"/downloads/python/vllm/v0-26-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Deploying and starting the vLLM OpenAI API server to ensure incoming requests are authenticated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/authentication.md","path":"/downloads/python/vllm/v0-26-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Serving chat models and configuring request parameters to prevent unauthorized tool execution when tool use is explicitly disabled.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/boundary-control.md","path":"/downloads/python/vllm/v0-26-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Setting up server configurations, YAML files, environment variables, and deployment scripts for vLLM services.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/configuration-source-integrity.md","path":"/downloads/python/vllm/v0-26-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"When serializing or deserializing vLLM models and LoRA adapters using Tensorizer and `TensorizerConfig` to prevent unauthorized inspection or theft.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/cryptography.md","path":"/downloads/python/vllm/v0-26-0/cryptography.md"},{"slug":"deserialization","title":"Deserialization","description":"Configuring deployment environments and environment variables for vLLM to handle untrusted requests safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/deserialization.md","path":"/downloads/python/vllm/v0-26-0/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Configuring the `LLM` engine and managing multimodal inputs where raw pre-computed embedding inputs could bypass media pre-processing validation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/escape-hatch.md","path":"/downloads/python/vllm/v0-26-0/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"Handling user-supplied file paths, multimodal media inputs, datasets, or template configurations in vLLM.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/file-handling.md","path":"/downloads/python/vllm/v0-26-0/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When handling incoming chat completion, tokenization, generation, and batch requests to ensure parameters conform to required types, ranges, lengths, and logical constraints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/input-contract-definition.md","path":"/downloads/python/vllm/v0-26-0/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Handling chat completion requests in a multi-tenant environment or shared vLLM instance where prompt prefix caches must be strictly partitioned.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/input-driven-boundary-selection.md","path":"/downloads/python/vllm/v0-26-0/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When validating, sanitizing, or parsing untrusted user chat messages, prompt strings, tool call arguments, or reasoning effort parameters to ensure unambiguous interpretation and prevent parser tamper…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/input-interpretation-safety.md","path":"/downloads/python/vllm/v0-26-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring cross-origin resource sharing policies for the vLLM API server to prevent cross-site request abuse.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/interface-protocol-hardening.md","path":"/downloads/python/vllm/v0-26-0/interface-protocol-hardening.md"},{"slug":"memory-safety","title":"Memory Safety","description":"Processing user-supplied sparse COO tensors or prompt embeddings to prevent out-of-bounds memory writes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/memory-safety.md","path":"/downloads/python/vllm/v0-26-0/memory-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring network connections, multi-port external load balancing, or benchmark HTTP clients communicating with remote or public endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/network-boundary.md","path":"/downloads/python/vllm/v0-26-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When configuring vLLM inference servers and processing media files, requests, or structured inputs that could cause resource exhaustion or out-of-memory errors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/resource-exhaustion.md","path":"/downloads/python/vllm/v0-26-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Deploying vLLM serving instances to production environments where unprivileged access and reduced attack surface are required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/runtime-environment-hardening.md","path":"/downloads/python/vllm/v0-26-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Setting up Hugging Face tokens, OpenAI API keys, and server authorization credentials for benchmark runners and API servers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/secret-handling.md","path":"/downloads/python/vllm/v0-26-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Developing or extending control message handlers for P2P offloading in vLLM to ensure protocol violations trigger immediate connection termination.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/security-control-integrity.md","path":"/downloads/python/vllm/v0-26-0/security-control-integrity.md"}]}]}]},{"slug":"ruby","label":"Ruby","catalogUrl":"https://securitycards.rewarelabs.com/llms/ruby.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/ruby.md","libraries":[{"slug":"devise","name":"Devise","latestVersion":"v5-0-4","versions":[{"version":"v5.0.4","versionSlug":"v5-0-4","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/ruby/devise/v5-0-4/","path":"/libraries/ruby/devise/v5-0-4/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4.md","bundlePath":"/downloads/ruby/devise/v5-0-4.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/0_security_blueprint.md","blueprintPath":"/downloads/ruby/devise/v5-0-4/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Protecting administrative or sensitive controller actions and routing endpoints from unauthorized access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/access-control.md","path":"/downloads/ruby/devise/v5-0-4/access-control.md"},{"slug":"authentication","title":"Authentication","description":"Setting up account confirmation rules, reconfirmation requirements, and token expiration periods.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/authentication.md","path":"/downloads/ruby/devise/v5-0-4/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When handling post-authentication return destinations from parameters or headers to prevent open redirect vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/boundary-control.md","path":"/downloads/ruby/devise/v5-0-4/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"Configuring credential hashing parameters and verifying authentication or reset tokens securely in Devise.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/cryptography.md","path":"/downloads/ruby/devise/v5-0-4/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"When configuring authentication, routes, and request forgery protection in a Devise-powered Rails application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/csrf.md","path":"/downloads/ruby/devise/v5-0-4/csrf.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Setting up Devise configuration options in initializers to restrict password input lengths and enforce credential input contracts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/input-contract-definition.md","path":"/downloads/ruby/devise/v5-0-4/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When extending or overriding `Devise::FailureApp` to customize post-failure redirection logic and handling untrusted request headers or URL parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/input-driven-boundary-selection.md","path":"/downloads/ruby/devise/v5-0-4/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring identity normalization rules, performing database authentication lookups, or validating confirmation tokens and parameters in Devise models.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/input-interpretation-safety.md","path":"/downloads/ruby/devise/v5-0-4/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring `devise_for` routes for web resources that are strictly intended for HTML views to prevent format confusion and restrict accepted content types.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/interface-protocol-hardening.md","path":"/downloads/ruby/devise/v5-0-4/interface-protocol-hardening.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring user models and authentication validations with Devise to bound input size for CPU-intensive hashing operations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/resource-exhaustion.md","path":"/downloads/ruby/devise/v5-0-4/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When managing authentication credentials, API responses, token serialization, password clearing, and secret key configuration in Devise applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/secret-handling.md","path":"/downloads/ruby/devise/v5-0-4/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Testing authentication behaviors, security hooks, session lifecycles, and Warden callbacks instead of relying solely on isolated controller tests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/security-control-integrity.md","path":"/downloads/ruby/devise/v5-0-4/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When managing user sign-in state, session invalidation on logout, password updates, or session timeouts in a Devise application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/devise/v5-0-4/session-management.md","path":"/downloads/ruby/devise/v5-0-4/session-management.md"}]}]},{"slug":"rails","name":"Rails","latestVersion":"v8-1-3","versions":[{"version":"v8.1.3","versionSlug":"v8-1-3","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/ruby/rails/v8-1-3/","path":"/libraries/ruby/rails/v8-1-3/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3.md","bundlePath":"/downloads/ruby/rails/v8-1-3.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/0_security_blueprint.md","blueprintPath":"/downloads/ruby/rails/v8-1-3/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When updating, editing, or deleting user-owned resources in controller actions to enforce ownership checks and prevent IDOR vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/access-control.md","path":"/downloads/ruby/rails/v8-1-3/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Querying database models that utilize composite primary keys using Active Record finder methods.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/api-contract-misuse.md","path":"/downloads/ruby/rails/v8-1-3/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing controller authentication callbacks or handling HTTP token and basic authentication headers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/authentication.md","path":"/downloads/ruby/rails/v8-1-3/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When handling cryptographically signed or encrypted tokens, messages, or session states across trust boundaries where payloads might be replayed or abused in unauthorized contexts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/boundary-control.md","path":"/downloads/ruby/rails/v8-1-3/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"When configuring ActiveRecord Encryption ciphers, key derivation parameters, and handling migration or decryption error workflows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/cryptography.md","path":"/downloads/ruby/rails/v8-1-3/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Building web applications, processing form submissions, and configuring state-changing endpoints in Rails controllers or views.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/csrf.md","path":"/downloads/ruby/rails/v8-1-3/csrf.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Handling request parameters that could influence code evaluation, method or class resolution, or template rendering.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/dangerous-execution.md","path":"/downloads/ruby/rails/v8-1-3/dangerous-execution.md"},{"slug":"deserialization","title":"Deserialization","description":"When configuring session cookies, message encryptors, message verifiers, or cryptographic serializers to handle untrusted data and prevent arbitrary object instantiation or execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/deserialization.md","path":"/downloads/ruby/rails/v8-1-3/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"When constructing database queries using raw SQL fragments or low-level ordering and clause methods in ActiveRecord.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/escape-hatch.md","path":"/downloads/ruby/rails/v8-1-3/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring asset delivery, middleware stacks, and reverse proxy offloading for public static files.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/file-handling.md","path":"/downloads/ruby/rails/v8-1-3/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building database queries, Common Table Expressions, or condition strings using Active Record methods with user-supplied input.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/injection.md","path":"/downloads/ruby/rails/v8-1-3/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When processing incoming HTTP request parameters, API payloads, or locale selections before passing them into model mass-assignment methods or application logic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/input-contract-definition.md","path":"/downloads/ruby/rails/v8-1-3/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"You are writing queries with raw SQL fragments or parsing input parameters where values must be canonicalized or normalized to ensure unambiguous interpretation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/input-interpretation-safety.md","path":"/downloads/ruby/rails/v8-1-3/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring global application security headers, transport security, content security policies, and permissions policies in Rails production or development environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/interface-protocol-hardening.md","path":"/downloads/ruby/rails/v8-1-3/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When operating the Rails application behind an upstream proxy, load balancer, or reverse proxy handling SSL termination and network routing boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/network-boundary.md","path":"/downloads/ruby/rails/v8-1-3/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering dynamic text, attributes, or user-supplied content within Action View ERB templates.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/output-encoding.md","path":"/downloads/ruby/rails/v8-1-3/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When setting up cloud storage configurations, database connection pools, or query caches in Rails applications to prevent thread and resource exhaustion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/resource-exhaustion.md","path":"/downloads/ruby/rails/v8-1-3/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring application environments for production deployment to prevent information disclosure.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/runtime-environment-hardening.md","path":"/downloads/ruby/rails/v8-1-3/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring request parameter logging and handling event notification payloads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/secret-handling.md","path":"/downloads/ruby/rails/v8-1-3/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Developing database migrations and defining ActiveRecord associations where model-level validations are insufficient to prevent race conditions and bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/security-control-integrity.md","path":"/downloads/ruby/rails/v8-1-3/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When managing session cookies, enforcing expiration limits, and handling user authentication state transitions in Rails.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/session-management.md","path":"/downloads/ruby/rails/v8-1-3/session-management.md"}]}]}]},{"slug":"rust","label":"Rust","catalogUrl":"https://securitycards.rewarelabs.com/llms/rust.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/rust.md","libraries":[{"slug":"actix-web","name":"Actix Web","latestVersion":"web-v4-14-0","versions":[{"version":"web.v4.14.0","versionSlug":"web-v4-14-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/rust/actix-web/web-v4-14-0/","path":"/libraries/rust/actix-web/web-v4-14-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0.md","bundlePath":"/downloads/rust/actix-web/web-v4-14-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/0_security_blueprint.md","blueprintPath":"/downloads/rust/actix-web/web-v4-14-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Enforcing access control, permissions, and request filtering across routes, resources, scopes, and middleware handlers in Actix Web.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/access-control.md","path":"/downloads/rust/actix-web/web-v4-14-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Extracting URL query parameters into strongly typed structures within Actix Web request handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/api-contract-misuse.md","path":"/downloads/rust/actix-web/web-v4-14-0/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When registering routes, scopes, and dynamic path segments in Actix-web applications to ensure requests are routed through proper security boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/boundary-control.md","path":"/downloads/rust/actix-web/web-v4-14-0/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"When performing RFC 6455 WebSocket handshake challenge-response generation using `hash_key`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/cryptography.md","path":"/downloads/rust/actix-web/web-v4-14-0/cryptography.md"},{"slug":"deserialization","title":"Deserialization","description":"Deserializing structured response data from remote endpoints via `ClientResponse::json()` where content-type checks and payload limits prevent memory exhaustion or unexpected parsing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/deserialization.md","path":"/downloads/rust/actix-web/web-v4-14-0/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Configuring network client transport capabilities and dependencies where transport-layer security features must be enforced instead of unencrypted bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/escape-hatch.md","path":"/downloads/rust/actix-web/web-v4-14-0/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring static file serving or processing user-influenced file paths and uploads to prevent unauthorized file access, path traversal, and dotfile disclosure.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/file-handling.md","path":"/downloads/rust/actix-web/web-v4-14-0/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Handling structured form and multipart file uploads where unexpected fields or duplicate parameters must be rejected to prevent parameter pollution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/input-contract-definition.md","path":"/downloads/rust/actix-web/web-v4-14-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Retrieving and validating request cookies or path match information where percent-decoding behavior affects security decisions and cryptographic checks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/input-interpretation-safety.md","path":"/downloads/rust/actix-web/web-v4-14-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Developing Actix Web applications and defining middleware, error handlers, or routes that require security headers like Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, or Content-S…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/interface-protocol-hardening.md","path":"/downloads/rust/actix-web/web-v4-14-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When configuring IP-based access controls, rate limiting, or network logging in Actix Web services deployed behind reverse proxies or handling direct client connections.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/network-boundary.md","path":"/downloads/rust/actix-web/web-v4-14-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Building HTTP responses, serving files, or returning string responders that include dynamic user data in Actix Web applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/output-encoding.md","path":"/downloads/rust/actix-web/web-v4-14-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring transport protocols, server instances, client connections, and request timeouts to protect against slowloris and resource exhaustion attacks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/resource-exhaustion.md","path":"/downloads/rust/actix-web/web-v4-14-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring crate dependencies and feature flags for production deployment","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/runtime-environment-hardening.md","path":"/downloads/rust/actix-web/web-v4-14-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When logging HTTP requests, client requests, or WebSocket connections containing sensitive credentials, bearer tokens, cookies, or authorization headers in Actix-web and `awc` applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/secret-handling.md","path":"/downloads/rust/actix-web/web-v4-14-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When registering security middleware, conditional wrappers, or route handlers in Actix Web applications to ensure security controls execute properly and do not fail open.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/security-control-integrity.md","path":"/downloads/rust/actix-web/web-v4-14-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Clearing session cookies or authentication state from the client browser during logout or session termination","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/session-management.md","path":"/downloads/rust/actix-web/web-v4-14-0/session-management.md"}]}]},{"slug":"axum","name":"Axum","latestVersion":"axum-v0-8-9","versions":[{"version":"axum.v0.8.9","versionSlug":"axum-v0-8-9","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/rust/axum/axum-v0-8-9/","path":"/libraries/rust/axum/axum-v0-8-9/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9.md","bundlePath":"/downloads/rust/axum/axum-v0-8-9.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/0_security_blueprint.md","blueprintPath":"/downloads/rust/axum/axum-v0-8-9/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When implementing access control, permission checks, or tenant isolation middleware and route layers in an Axum application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/access-control.md","path":"/downloads/rust/axum/axum-v0-8-9/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When defining axum handler functions that use extractors to parse request bodies or path parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/api-contract-misuse.md","path":"/downloads/rust/axum/axum-v0-8-9/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When building Axum request extractors or middleware that must verify incoming bearer tokens or credentials before allowing route handlers to execute.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/authentication.md","path":"/downloads/rust/axum/axum-v0-8-9/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Applying middleware that modifies request URIs or properties affecting routing decisions before requests are handled by Axum.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/boundary-control.md","path":"/downloads/rust/axum/axum-v0-8-9/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"Handling sensitive session state, tokens, or confidential data in client cookies using axum-extra.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/cryptography.md","path":"/downloads/rust/axum/axum-v0-8-9/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Handling OAuth authorization callback requests where state parameters must be verified against server-stored CSRF tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/csrf.md","path":"/downloads/rust/axum/axum-v0-8-9/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"When implementing zero-copy request parsing in Axum using `JsonDeserializer` where fields might contain escape sequences.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/deserialization.md","path":"/downloads/rust/axum/axum-v0-8-9/deserialization.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When building request handlers in axum that receive data and require field length, numerical bounds, or string pattern safety beyond standard type deserialization.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/input-contract-definition.md","path":"/downloads/rust/axum/axum-v0-8-9/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Extracting URL path parameters from incoming requests where percent-decoding could transform traversal sequences.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/input-interpretation-safety.md","path":"/downloads/rust/axum/axum-v0-8-9/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring security headers and cross-origin resource sharing policies for HTTP responses in an axum web application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/interface-protocol-hardening.md","path":"/downloads/rust/axum/axum-v0-8-9/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Binding network interfaces with `tokio::net::TcpListener` for `axum::serve` to control client access boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/network-boundary.md","path":"/downloads/rust/axum/axum-v0-8-9/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering dynamic user-supplied data inside `Html` response types in Axum handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/output-encoding.md","path":"/downloads/rust/axum/axum-v0-8-9/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Building or configuring Axum HTTP routes and services that handle incoming request bodies, file uploads, or concurrent workloads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/resource-exhaustion.md","path":"/downloads/rust/axum/axum-v0-8-9/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring application state, middleware layers, or cryptographic keys that require sensitive credentials and secrets.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/secret-handling.md","path":"/downloads/rust/axum/axum-v0-8-9/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Registering security-critical middleware layers such as authentication, authorization, or rate limiting on an Axum Router.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/security-control-integrity.md","path":"/downloads/rust/axum/axum-v0-8-9/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Managing session identifiers or authentication cookies via response headers and cookie jars in Axum handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/session-management.md","path":"/downloads/rust/axum/axum-v0-8-9/session-management.md"}]}]},{"slug":"rocket","name":"Rocket","latestVersion":"v0-5-1","versions":[{"version":"v0.5.1","versionSlug":"v0-5-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/rust/rocket/v0-5-1/","path":"/libraries/rust/rocket/v0-5-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1.md","bundlePath":"/downloads/rust/rocket/v0-5-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/0_security_blueprint.md","blueprintPath":"/downloads/rust/rocket/v0-5-1/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Use when implementing custom authentication, role checks, or ownership validation for Rocket route handlers to prevent unauthorized access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/access-control.md","path":"/downloads/rust/rocket/v0-5-1/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When developing route handlers in Rocket that mutate session or cookie state and need to inspect those modifications within the same request lifecycle.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/api-contract-misuse.md","path":"/downloads/rust/rocket/v0-5-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When implementing transport-layer client identity verification and requiring valid cryptographic certificates for endpoint access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/authentication.md","path":"/downloads/rust/rocket/v0-5-1/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Configuring Rocket applications that are directly internet-facing and not behind a trusted reverse proxy.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/boundary-control.md","path":"/downloads/rust/rocket/v0-5-1/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring concurrency and worker thread parameters for Rocket applications using `Config::figment()` or trusted environment variables.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/configuration-source-integrity.md","path":"/downloads/rust/rocket/v0-5-1/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Instantiating or configuring secret keys manually in the application configuration using Rocket's secret key management.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/cryptography.md","path":"/downloads/rust/rocket/v0-5-1/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring session cookies and handling state-changing requests or method-overridden endpoints in Rocket.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/csrf.md","path":"/downloads/rust/rocket/v0-5-1/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"Deserializing untrusted payloads into domain or model structures using Serde where primary keys or status codes are present.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/deserialization.md","path":"/downloads/rust/rocket/v0-5-1/deserialization.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Defining web routes and handling parameters in a Rocket application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/escape-hatch.md","path":"/downloads/rust/rocket/v0-5-1/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"When serving static assets, handling multi-segment dynamic paths, processing file uploads, or mapping user-supplied input to file system paths.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/file-handling.md","path":"/downloads/rust/rocket/v0-5-1/file-handling.md"},{"slug":"injection","title":"Injection","description":"When executing database queries via `rocket_db_pools` and SQL drivers like `sqlx` in Rocket request handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/injection.md","path":"/downloads/rust/rocket/v0-5-1/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining form structs and validating incoming form and query parameters using Rocket's `","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/input-contract-definition.md","path":"/downloads/rust/rocket/v0-5-1/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Building HTTP redirect responses where untrusted input or dynamic values might otherwise be passed directly into redirect constructors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/input-driven-boundary-selection.md","path":"/downloads/rust/rocket/v0-5-1/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing, decoding, normalizing, or validating untrusted URIs, query strings, and input parameters to prevent path ambiguity, parser differentials, and validation bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/input-interpretation-safety.md","path":"/downloads/rust/rocket/v0-5-1/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"When crafting HTTP responses in Rocket that require protocol-level headers or when registering protocol upgrade handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/interface-protocol-hardening.md","path":"/downloads/rust/rocket/v0-5-1/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When deploying a Rocket application behind a reverse proxy or load balancer and handling client IP addresses for network boundary enforcement.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/network-boundary.md","path":"/downloads/rust/rocket/v0-5-1/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When rendering dynamic or user-controlled content inside `rocket::response::content::RawHtml` responses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/output-encoding.md","path":"/downloads/rust/rocket/v0-5-1/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring global data limits, handling file uploads, or processing incoming streams and form payloads in Rocket applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/resource-exhaustion.md","path":"/downloads/rust/rocket/v0-5-1/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring the Rocket application for production deployment to ensure secure runtime settings and default protective header injection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/runtime-environment-hardening.md","path":"/downloads/rust/rocket/v0-5-1/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring cryptographic secret keys, handling encrypted private cookies, and managing sensitive authentication tokens or credentials in Rocket applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/secret-handling.md","path":"/downloads/rust/rocket/v0-5-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When registering global fairings, custom Shield policies, and request/response interceptors in a Rocket application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/security-control-integrity.md","path":"/downloads/rust/rocket/v0-5-1/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Developing authentication, session management, or stateful cookie handling features using Rocket's `CookieJar`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/session-management.md","path":"/downloads/rust/rocket/v0-5-1/session-management.md"}]}]},{"slug":"salvo","name":"Salvo","latestVersion":"v0-94-0","versions":[{"version":"v0.94.0","versionSlug":"v0-94-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/rust/salvo/v0-94-0/","path":"/libraries/rust/salvo/v0-94-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0.md","bundlePath":"/downloads/rust/salvo/v0-94-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/0_security_blueprint.md","blueprintPath":"/downloads/rust/salvo/v0-94-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Developing and configuring cross-origin resource sharing (CORS) security headers, preflight caching, and origin boundaries in Salvo applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/access-control.md","path":"/downloads/rust/salvo/v0-94-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When constructing HTTP redirects using untrusted or dynamically computed input data in Salvo handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/api-contract-misuse.md","path":"/downloads/rust/salvo/v0-94-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Setting up JWT authentication or token decoders in Salvo applications to authenticate clients and verify credentials.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/authentication.md","path":"/downloads/rust/salvo/v0-94-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Structuring the router tree to ensure that authentication and authorization hoops are only applied to protected routes and do not inadvertently enclose public endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/boundary-control.md","path":"/downloads/rust/salvo/v0-94-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring Swagger UI endpoints in Salvo OpenAPI integrations where untrusted users could manipulate configuration parameters via URL query parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/configuration-source-integrity.md","path":"/downloads/rust/salvo/v0-94-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"When storing or verifying user credentials and passwords in Salvo database examples or applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/cryptography.md","path":"/downloads/rust/salvo/v0-94-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Developing state-changing APIs and web routes in Salvo that require protection against cross-site request forgery using tokens, session stores, custom finders, and secure cookie configurations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/csrf.md","path":"/downloads/rust/salvo/v0-94-0/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring static asset directories, file upload storage stores, or local file handling paths in Salvo applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/file-handling.md","path":"/downloads/rust/salvo/v0-94-0/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When defining request data transfer objects, parameters, and schema structures using Salvo's OpenAPI integration macros to ensure malformed input is rejected.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/input-contract-definition.md","path":"/downloads/rust/salvo/v0-94-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring proxy routing in Salvo to handle upstream requests safely and prevent attackers from bypassing security controls via encoded or relative path components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/input-interpretation-safety.md","path":"/downloads/rust/salvo/v0-94-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring network connection settings, transport negotiation protocols, and request timeouts in Salvo applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/interface-protocol-hardening.md","path":"/downloads/rust/salvo/v0-94-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring rate-limiting, proxy routing, or client origin identification behind network load balancers or reverse proxies where incoming request headers can be manipulated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/network-boundary.md","path":"/downloads/rust/salvo/v0-94-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering dynamic variables retrieved from session states or flash messages into HTML responses using `Text::Html` in Salvo handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/output-encoding.md","path":"/downloads/rust/salvo/v0-94-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When defining routes and handling incoming requests in Salvo to prevent resource exhaustion from large payloads or unbounded path parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/resource-exhaustion.md","path":"/downloads/rust/salvo/v0-94-0/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When configuring authentication, session handlers, JWT decoders, or encrypted keys in Salvo applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/secret-handling.md","path":"/downloads/rust/salvo/v0-94-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When writing custom authentication handlers or middleware in Salvo that need to reject unauthorized requests and prevent downstream handler execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/security-control-integrity.md","path":"/downloads/rust/salvo/v0-94-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session handling in Salvo applications deployed behind an upstream proxy or load balancer that terminates TLS.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/session-management.md","path":"/downloads/rust/salvo/v0-94-0/session-management.md"}]}]},{"slug":"serde","name":"Serde","latestVersion":"v1-0-229","versions":[{"version":"v1.0.229","versionSlug":"v1-0-229","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/rust/serde/v1-0-229/","path":"/libraries/rust/serde/v1-0-229/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/rust/serde/v1-0-229.md","bundlePath":"/downloads/rust/serde/v1-0-229.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/rust/serde/v1-0-229/0_security_blueprint.md","blueprintPath":"/downloads/rust/serde/v1-0-229/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"serializing data structures that utilize interior mutability types like `RefCell` where active mutable borrow guards could cause runtime serialization errors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/serde/v1-0-229/api-contract-misuse.md","path":"/downloads/rust/serde/v1-0-229/api-contract-misuse.md"},{"slug":"deserialization","title":"Deserialization","description":"When deserializing untrusted input into custom structures, enums, or derived types to prevent type confusion, unauthorized object construction, and gadget execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/serde/v1-0-229/deserialization.md","path":"/downloads/rust/serde/v1-0-229/deserialization.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Deserializing untrusted payloads into structs or enums where unexpected or unrecognized properties should be rejected.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/serde/v1-0-229/input-contract-definition.md","path":"/downloads/rust/serde/v1-0-229/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Deserializing raw byte sequences into string types using custom visitor implementations","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/serde/v1-0-229/input-interpretation-safety.md","path":"/downloads/rust/serde/v1-0-229/input-interpretation-safety.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Deserializing untrusted inputs where certain payload fields are irrelevant or unused.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/serde/v1-0-229/resource-exhaustion.md","path":"/downloads/rust/serde/v1-0-229/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When serializing data structures containing sensitive information such as secret keys, passwords, or session tokens to prevent unauthorized exposure.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/rust/serde/v1-0-229/secret-handling.md","path":"/downloads/rust/serde/v1-0-229/secret-handling.md"}]}]}]},{"slug":"swift","label":"Swift","catalogUrl":"https://securitycards.rewarelabs.com/llms/swift.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/swift.md","libraries":[{"slug":"swift-crypto","name":"Swift Crypto","latestVersion":"4-5-1","versions":[{"version":"4.5.1","versionSlug":"4-5-1","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/swift/swift-crypto/4-5-1/","path":"/libraries/swift/swift-crypto/4-5-1/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1.md","bundlePath":"/downloads/swift/swift-crypto/4-5-1.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/0_security_blueprint.md","blueprintPath":"/downloads/swift/swift-crypto/4-5-1/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When establishing secure hybrid public-key encryption (HPKE) communications between sender and recipient endpoints.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/api-contract-misuse.md","path":"/downloads/swift/swift-crypto/4-5-1/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing hybrid public-key encryption workflows requiring identity verification and sender authentication.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/authentication.md","path":"/downloads/swift/swift-crypto/4-5-1/authentication.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring directory paths and environment variable overrides for hash-based X.509 certificate and CRL resolution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/configuration-source-integrity.md","path":"/downloads/swift/swift-crypto/4-5-1/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"You are deriving encryption keys from user passwords or hashing passwords using PBKDF2 or Scrypt primitives in CryptoExtras and BoringSSL.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/cryptography.md","path":"/downloads/swift/swift-crypto/4-5-1/cryptography.md"},{"slug":"deserialization","title":"Deserialization","description":"Parsing DER-encoded ASN.1 data structures containing timestamps from untrusted sources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/deserialization.md","path":"/downloads/swift/swift-crypto/4-5-1/deserialization.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Instantiating cryptographic keys, nonces, or sealed boxes from external or raw binary inputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/input-contract-definition.md","path":"/downloads/swift/swift-crypto/4-5-1/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Decoding low-level ASN.1 data structures, encoded public/private keys, or PKCS","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/input-interpretation-safety.md","path":"/downloads/swift/swift-crypto/4-5-1/input-interpretation-safety.md"},{"slug":"memory-safety","title":"Memory Safety","description":"When managing input and output memory buffers for low-level cryptographic primitives, key derivation, or block cipher operations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/memory-safety.md","path":"/downloads/swift/swift-crypto/4-5-1/memory-safety.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Parsing RSA keys from external sources to prevent excessive computational resource consumption.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/resource-exhaustion.md","path":"/downloads/swift/swift-crypto/4-5-1/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring process sandboxing and system access restrictions in applications utilizing underlying cryptographic components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/runtime-environment-hardening.md","path":"/downloads/swift/swift-crypto/4-5-1/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When managing derived keys, shared secrets, and private key representations in application workflows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/secret-handling.md","path":"/downloads/swift/swift-crypto/4-5-1/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring X509 verification parameters where unauthorized or unsupported verification flags could cause verification failures or fail-closed behavior.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/security-control-integrity.md","path":"/downloads/swift/swift-crypto/4-5-1/security-control-integrity.md"}]}]},{"slug":"swift-nio","name":"Swift Nio","latestVersion":"2-101-3","versions":[{"version":"2.101.3","versionSlug":"2-101-3","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/swift/swift-nio/2-101-3/","path":"/libraries/swift/swift-nio/2-101-3/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3.md","bundlePath":"/downloads/swift/swift-nio/2-101-3.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/0_security_blueprint.md","blueprintPath":"/downloads/swift/swift-nio/2-101-3/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Creating or modifying files and directories, or inspecting file metadata for authorization and permission checks in Swift NIO.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/access-control.md","path":"/downloads/swift/swift-nio/2-101-3/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When configuring network bootstraps with dynamic event loop groups or verifying event loop thread isolation for state mutations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/api-contract-misuse.md","path":"/downloads/swift/swift-nio/2-101-3/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When implementing protocol upgrades such as transitioning from HTTP/1.1 to WebSocket using client upgrade handlers where payload data may arrive in the same TCP chunk as the protocol response head.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/boundary-control.md","path":"/downloads/swift/swift-nio/2-101-3/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Resolving home directory paths or security-sensitive configuration file locations within application startup or user session initialization.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/configuration-source-integrity.md","path":"/downloads/swift/swift-nio/2-101-3/configuration-source-integrity.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Interacting with low-level file handles or performing native system operations using raw POSIX file descriptors.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/escape-hatch.md","path":"/downloads/swift/swift-nio/2-101-3/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"When creating new files or replacing existing files on disk to prevent race conditions, unauthorized access, or partial file materialization.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/file-handling.md","path":"/downloads/swift/swift-nio/2-101-3/file-handling.md"},{"slug":"injection","title":"Injection","description":"Constructing dynamic HTTP headers in SwiftNIO before outbound transmission to prevent header injection and request smuggling.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/injection.md","path":"/downloads/swift/swift-nio/2-101-3/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Developing networking code using Swift NIO where untrusted input is passed to buffer indexing APIs or HTTP header population methods.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/input-contract-definition.md","path":"/downloads/swift/swift-nio/2-101-3/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When processing comma-separated HTTP headers like `connection` or `set-cookie` using `HTTPHeaders`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/input-interpretation-safety.md","path":"/downloads/swift/swift-nio/2-101-3/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring HTTP client and server channels, encoders, and pipelines in SwiftNIO to prevent request/response smuggling and header injection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/interface-protocol-hardening.md","path":"/downloads/swift/swift-nio/2-101-3/interface-protocol-hardening.md"},{"slug":"memory-safety","title":"Memory Safety","description":"Handling low-level buffer pointer access via APIs like `withUnsafeReadableBytes`, `withVeryUnsafeMutableBytes`, or pooled buffer storage management in SwiftNIO.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/memory-safety.md","path":"/downloads/swift/swift-nio/2-101-3/memory-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring network boundary bindings and inspecting host network interfaces using SwiftNIO socket and interface APIs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/network-boundary.md","path":"/downloads/swift/swift-nio/2-101-3/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When setting up HTTP or WebSocket servers and decoders in SwiftNIO to process untrusted network payloads.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/resource-exhaustion.md","path":"/downloads/swift/swift-nio/2-101-3/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring runtime file descriptors and open options when the application executes subprocesses to prevent handle leaks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/swift-nio/2-101-3/runtime-environment-hardening.md","path":"/downloads/swift/swift-nio/2-101-3/runtime-environment-hardening.md"}]}]},{"slug":"vapor","name":"Vapor","latestVersion":"4-122-0","versions":[{"version":"4.122.0","versionSlug":"4-122-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/swift/vapor/4-122-0/","path":"/libraries/swift/vapor/4-122-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0.md","bundlePath":"/downloads/swift/vapor/4-122-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/0_security_blueprint.md","blueprintPath":"/downloads/swift/vapor/4-122-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Enforcing role or permission checks to determine whether an authenticated user may access a protected route or tenant resource in Vapor.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/access-control.md","path":"/downloads/swift/vapor/4-122-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing route closures and handling incoming requests where request-bound services such as `req.client` must be accessed.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/api-contract-misuse.md","path":"/downloads/swift/vapor/4-122-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Authenticating users with credentials or verifying incoming JWT bearer tokens in Vapor.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/authentication.md","path":"/downloads/swift/vapor/4-122-0/authentication.md"},{"slug":"cryptography","title":"Cryptography","description":"When generating high-entropy random values for bearer tokens, API credentials, or symmetric keys.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/cryptography.md","path":"/downloads/swift/vapor/4-122-0/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring session middleware and cookie factories for routes that use ambient credentials and state-changing actions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/csrf.md","path":"/downloads/swift/vapor/4-122-0/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring `FileMiddleware` for serving static assets in a Vapor application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/file-handling.md","path":"/downloads/swift/vapor/4-122-0/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Validating untrusted HTTP request content, query parameters, or JSON payloads against explicit type, range, format, and requirement rules before executing business logic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/input-contract-definition.md","path":"/downloads/swift/vapor/4-122-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"You are verifying incoming request content types and security controls depend on specific parameters like character encodings.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/input-interpretation-safety.md","path":"/downloads/swift/vapor/4-122-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Handling incoming HTTP request headers or setting outgoing response headers where case sensitivity could lead to protocol confusion or security control bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/interface-protocol-hardening.md","path":"/downloads/swift/vapor/4-122-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When configuring network boundaries or routing endpoints that handle Basic authentication and credentials.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/network-boundary.md","path":"/downloads/swift/vapor/4-122-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Building HTTP responses or rendering dynamic templates with user-supplied data in Vapor.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/output-encoding.md","path":"/downloads/swift/vapor/4-122-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring routes that handle incoming HTTP request payloads and file uploads to prevent resource exhaustion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/resource-exhaustion.md","path":"/downloads/swift/vapor/4-122-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring global middleware and application error handling during server bootstrap to ensure internal error details are properly masked in production.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/runtime-environment-hardening.md","path":"/downloads/swift/vapor/4-122-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When loading API keys, cryptographic secrets, or database credentials in Vapor route handlers and configuration setups.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/secret-handling.md","path":"/downloads/swift/vapor/4-122-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring the application middleware chain in Vapor to ensure cross-origin resource sharing headers are correctly applied to error and abort responses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/security-control-integrity.md","path":"/downloads/swift/vapor/4-122-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session cookie attributes, registering session middleware, and terminating user sessions in Vapor applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/session-management.md","path":"/downloads/swift/vapor/4-122-0/session-management.md"}]}]}]},{"slug":"typescript","label":"TypeScript","catalogUrl":"https://securitycards.rewarelabs.com/llms/typescript.txt","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript.md","libraries":[{"slug":"adonisjs","name":"Adonisjs","latestVersion":"v7-3-5","versions":[{"version":"v7.3.5","versionSlug":"v7-3-5","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/adonisjs/v7-3-5/","path":"/libraries/typescript/adonisjs/v7-3-5/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5.md","bundlePath":"/downloads/typescript/adonisjs/v7-3-5.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/0_security_blueprint.md","blueprintPath":"/downloads/typescript/adonisjs/v7-3-5/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When implementing controller actions, route handlers, or middleware that handle sensitive data mutations, access control, or resource retrieval.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/access-control.md","path":"/downloads/typescript/adonisjs/v7-3-5/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Validating incoming request input using tryValidateUsing in AdonisJS controllers and inspecting the resulting error tuple.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/api-contract-misuse.md","path":"/downloads/typescript/adonisjs/v7-3-5/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Verifying user credentials during authentication or validating token-based and verification tokens.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/authentication.md","path":"/downloads/typescript/adonisjs/v7-3-5/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Processing incoming HTTP request data inside controllers before executing core business logic.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/boundary-control.md","path":"/downloads/typescript/adonisjs/v7-3-5/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Validating and restricting allowed environment variables at application startup to ensure configuration integrity.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/configuration-source-integrity.md","path":"/downloads/typescript/adonisjs/v7-3-5/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Implementing user authentication and password storage mechanisms in AdonisJS applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/cryptography.md","path":"/downloads/typescript/adonisjs/v7-3-5/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Developing server-rendered form submissions using AdonisJS Shield.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/csrf.md","path":"/downloads/typescript/adonisjs/v7-3-5/csrf.md"},{"slug":"file-handling","title":"File Handling","description":"When handling user-uploaded files, defining storage paths, or serving file downloads to prevent path traversal and resource exhaustion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/file-handling.md","path":"/downloads/typescript/adonisjs/v7-3-5/file-handling.md"},{"slug":"injection","title":"Injection","description":"Building database queries with dynamic user input using Lucid query builder or raw queries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/injection.md","path":"/downloads/typescript/adonisjs/v7-3-5/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Use when validating incoming request bodies, query parameters, or headers against strict schemas before processing data in controller actions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/input-contract-definition.md","path":"/downloads/typescript/adonisjs/v7-3-5/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When handling dynamic route parameters to select an OAuth provider or adapter in AdonisJS applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/input-driven-boundary-selection.md","path":"/downloads/typescript/adonisjs/v7-3-5/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing and processing incoming user verification tokens in request handlers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/input-interpretation-safety.md","path":"/downloads/typescript/adonisjs/v7-3-5/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring the static file server to attach security-focused HTTP headers to protect against protocol confusion and MIME-sniffing vulnerabilities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/interface-protocol-hardening.md","path":"/downloads/typescript/adonisjs/v7-3-5/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring AdonisJS HTTP settings behind a proxy to ensure correct handling of client IP addresses and prevent spoofing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/network-boundary.md","path":"/downloads/typescript/adonisjs/v7-3-5/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering internationalized translation strings with dynamic user-supplied interpolation parameters inside Edge templates.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/output-encoding.md","path":"/downloads/typescript/adonisjs/v7-3-5/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Defining body parser configurations to restrict incoming payload sizes for JSON, form, and multipart requests in AdonisJS applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/resource-exhaustion.md","path":"/downloads/typescript/adonisjs/v7-3-5/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Deploying the application to a production server where development route generation and debug tooling must be disabled.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/runtime-environment-hardening.md","path":"/downloads/typescript/adonisjs/v7-3-5/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring application settings, encryption keys, database connections, mail services, storage drivers, authentication guards, and API integrations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/secret-handling.md","path":"/downloads/typescript/adonisjs/v7-3-5/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Developing policy classes with `before()` hooks to control access to specific authorization actions in AdonisJS.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/security-control-integrity.md","path":"/downloads/typescript/adonisjs/v7-3-5/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring session cookie security options in AdonisJS applications","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/adonisjs/v7-3-5/session-management.md","path":"/downloads/typescript/adonisjs/v7-3-5/session-management.md"}]}]},{"slug":"bullmq","name":"Bullmq","latestVersion":"v5-81-3","versions":[{"version":"v5.81.3","versionSlug":"v5-81-3","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/bullmq/v5-81-3/","path":"/libraries/typescript/bullmq/v5-81-3/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3.md","bundlePath":"/downloads/typescript/bullmq/v5-81-3.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/0_security_blueprint.md","blueprintPath":"/downloads/typescript/bullmq/v5-81-3/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When manually fetching jobs from a queue and performing custom state transitions or lock extensions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/access-control.md","path":"/downloads/typescript/bullmq/v5-81-3/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When defining worker processor functions, custom Lua scripts, or handling cancellation tokens where exact parameter signatures and key counts are required by BullMQ APIs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/api-contract-misuse.md","path":"/downloads/typescript/bullmq/v5-81-3/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When implementing or managing explicit job lock extensions and concurrency control across distributed worker instances.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/boundary-control.md","path":"/downloads/typescript/bullmq/v5-81-3/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Initializing BullMQ components such as `Queue` or `Worker` using configuration parameters derived from environment variables or external sources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/configuration-source-integrity.md","path":"/downloads/typescript/bullmq/v5-81-3/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"When instantiating a Queue in BullMQ and configuring repeatable job key generation settings to meet compliance standards.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/cryptography.md","path":"/downloads/typescript/bullmq/v5-81-3/cryptography.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Instantiating a `Worker` with a sandboxed file path or URL processor where processor paths must be configured securely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/dangerous-execution.md","path":"/downloads/typescript/bullmq/v5-81-3/dangerous-execution.md"},{"slug":"file-handling","title":"File Handling","description":"Configuring path mappings or loading Lua scripts from directory paths where untrusted input could influence filesystem paths.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/file-handling.md","path":"/downloads/typescript/bullmq/v5-81-3/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Enforcing input validation and schema structures on queue names, cron expressions, timezones, and scheduler end dates before registering tasks or instantiating components in BullMQ.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/input-contract-definition.md","path":"/downloads/typescript/bullmq/v5-81-3/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When validating, sanitizing, and restricting numeric formats in job payload dictionaries or scheduler data before serialization.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/input-interpretation-safety.md","path":"/downloads/typescript/bullmq/v5-81-3/input-interpretation-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring network access and connection endpoints for BullMQ producers and workers connecting to Redis or AWS MemoryDB.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/network-boundary.md","path":"/downloads/typescript/bullmq/v5-81-3/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When managing finalized jobs in Redis to prevent unbounded storage growth and memory exhaustion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/resource-exhaustion.md","path":"/downloads/typescript/bullmq/v5-81-3/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"When instantiating sandboxed job processors in BullMQ to isolate execution and prevent resource leaks or unintended environment variable inheritance.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/runtime-environment-hardening.md","path":"/downloads/typescript/bullmq/v5-81-3/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring Redis connection parameters, client options, or private registries when initializing BullMQ queues, workers, or package managers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/secret-handling.md","path":"/downloads/typescript/bullmq/v5-81-3/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring worker locks and handling lock renewal failures to ensure jobs fail closed and prevent concurrent duplicate execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/security-control-integrity.md","path":"/downloads/typescript/bullmq/v5-81-3/security-control-integrity.md"}]}]},{"slug":"cheerio","name":"Cheerio","latestVersion":"v1-2-0","versions":[{"version":"v1.2.0","versionSlug":"v1-2-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/cheerio/v1-2-0/","path":"/libraries/typescript/cheerio/v1-2-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/cheerio/v1-2-0.md","bundlePath":"/downloads/typescript/cheerio/v1-2-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/cheerio/v1-2-0/0_security_blueprint.md","blueprintPath":"/downloads/typescript/cheerio/v1-2-0/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When processing binary buffer streams or multi-byte encoded inputs with Cheerio.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/cheerio/v1-2-0/api-contract-misuse.md","path":"/downloads/typescript/cheerio/v1-2-0/api-contract-misuse.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Parsing untrusted, malformed, remote, binary, or partial HTML and XML content using Cheerio.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/cheerio/v1-2-0/input-interpretation-safety.md","path":"/downloads/typescript/cheerio/v1-2-0/input-interpretation-safety.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Setting dynamic attribute values on elements before serializing them back to HTML using Cheerio.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/cheerio/v1-2-0/output-encoding.md","path":"/downloads/typescript/cheerio/v1-2-0/output-encoding.md"}]}]},{"slug":"drizzle-orm","name":"Drizzle Orm","latestVersion":"0-45-2","versions":[{"version":"0.45.2","versionSlug":"0-45-2","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/drizzle-orm/0-45-2/","path":"/libraries/typescript/drizzle-orm/0-45-2/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2.md","bundlePath":"/downloads/typescript/drizzle-orm/0-45-2.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/0_security_blueprint.md","blueprintPath":"/downloads/typescript/drizzle-orm/0-45-2/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Developing database queries, defining table policies, or creating database views in multi-tenant or protected environments where unauthorized access across boundaries must be prevented.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/access-control.md","path":"/downloads/typescript/drizzle-orm/0-45-2/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When writing transactional boundaries and executing multi-statement operations across various database drivers in Drizzle ORM.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/api-contract-misuse.md","path":"/downloads/typescript/drizzle-orm/0-45-2/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Applying query caching and custom cache tags in application database queries where data from multiple users or tenants crosses application boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/boundary-control.md","path":"/downloads/typescript/drizzle-orm/0-45-2/boundary-control.md"},{"slug":"injection","title":"Injection","description":"When building custom SQL queries, database clauses, or expressions where dynamic values or user input must be included securely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/injection.md","path":"/downloads/typescript/drizzle-orm/0-45-2/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When validating HTTP request payloads, CLI options, database schema snapshots, and serialized configuration inputs before processing application data.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/input-contract-definition.md","path":"/downloads/typescript/drizzle-orm/0-45-2/input-contract-definition.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When configuring custom HTTP proxy drivers to handle database queries over network boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/network-boundary.md","path":"/downloads/typescript/drizzle-orm/0-45-2/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Executing multi-statement transactional database queries where connection leaks could exhaust the connection pool and cause service downtime.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/resource-exhaustion.md","path":"/downloads/typescript/drizzle-orm/0-45-2/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring database connections, CLI schemas, or logging options where secrets, tokens, and query parameters are exposed.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/secret-handling.md","path":"/downloads/typescript/drizzle-orm/0-45-2/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When managing database transactions in SQLite with `db.transaction()` and handling errors inside transaction callbacks.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/security-control-integrity.md","path":"/downloads/typescript/drizzle-orm/0-45-2/security-control-integrity.md"}]}]},{"slug":"feathers","name":"Feathers","latestVersion":"v5-0-46","versions":[{"version":"v5.0.46","versionSlug":"v5-0-46","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/feathers/v5-0-46/","path":"/libraries/typescript/feathers/v5-0-46/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46.md","bundlePath":"/downloads/typescript/feathers/v5-0-46.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/0_security_blueprint.md","blueprintPath":"/downloads/typescript/feathers/v5-0-46/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When managing user permissions, capabilities, roles, and administrative update boundaries across Feathers services and authentication flows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/access-control.md","path":"/downloads/typescript/feathers/v5-0-46/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Handling and logging database exceptions thrown by the `@feathersjs/knex` adapter without leaking sensitive database details to clients.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/api-contract-misuse.md","path":"/downloads/typescript/feathers/v5-0-46/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"When establishing identity verification, registering authentication strategies, and protecting service or route endpoints in a Feathers application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/authentication.md","path":"/downloads/typescript/feathers/v5-0-46/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Handling incoming requests from untrusted clients, extracting parameters from query contexts, or distinguishing external transport requests from internal service calls.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/boundary-control.md","path":"/downloads/typescript/feathers/v5-0-46/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring application settings and environment variables in Feathers v5 applications where implicit automatic environment variable substitution is no longer supported by `@feathersjs/configuration`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/configuration-source-integrity.md","path":"/downloads/typescript/feathers/v5-0-46/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"When defining data resolvers to prepare user credentials before saving them to the database in a Feathers application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/cryptography.md","path":"/downloads/typescript/feathers/v5-0-46/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Configuring authentication client token storage in Feathers applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/csrf.md","path":"/downloads/typescript/feathers/v5-0-46/csrf.md"},{"slug":"deserialization","title":"Deserialization","description":"When processing incoming requests over HTTP REST transports where query parameters are deserialized strictly as strings.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/deserialization.md","path":"/downloads/typescript/feathers/v5-0-46/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Handling file uploads through Express middleware and Feathers services where uploaded file attributes must be validated.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/file-handling.md","path":"/downloads/typescript/feathers/v5-0-46/file-handling.md"},{"slug":"injection","title":"Injection","description":"When initializing MongoDB services in Feathers to restrict query update operators and prevent unauthorized field modification.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/injection.md","path":"/downloads/typescript/feathers/v5-0-46/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining and validating incoming service data and query parameters using schema hooks to reject malformed input and unexpected properties.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/input-contract-definition.md","path":"/downloads/typescript/feathers/v5-0-46/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Building nested routes, deep links, or OAuth redirect flows in Feathers applications where route parameters and authentication tokens cross security boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/input-driven-boundary-selection.md","path":"/downloads/typescript/feathers/v5-0-46/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring the express query parser in a Feathers application when handling URL query strings with large array parameters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/input-interpretation-safety.md","path":"/downloads/typescript/feathers/v5-0-46/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Use when designing inter-component calls, configuring service methods, managing real-time channels, and transferring authentication context across network and application component boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/interface-protocol-hardening.md","path":"/downloads/typescript/feathers/v5-0-46/interface-protocol-hardening.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Rendering dynamic user content or API responses into the browser DOM using properties like innerHTML.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/output-encoding.md","path":"/downloads/typescript/feathers/v5-0-46/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When accepting multipart file uploads and parsing JSON request bodies in a Feathers application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/resource-exhaustion.md","path":"/downloads/typescript/feathers/v5-0-46/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Developing client-side applications with Feathers and configuring the `@feathersjs/authentication-client` module for token persistence.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/secret-handling.md","path":"/downloads/typescript/feathers/v5-0-46/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Developing Feathers service methods, custom authentication services, internal adapter operations, or handling request execution paths where security controls like hooks and setup initialization must r…","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/security-control-integrity.md","path":"/downloads/typescript/feathers/v5-0-46/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Implementing logout functionality or managing server-side session and token invalidation in Feathers applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/feathers/v5-0-46/session-management.md","path":"/downloads/typescript/feathers/v5-0-46/session-management.md"}]}]},{"slug":"helmet","name":"Helmet","latestVersion":"v8-3-0","versions":[{"version":"v8.3.0","versionSlug":"v8-3-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/helmet/v8-3-0/","path":"/libraries/typescript/helmet/v8-3-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0.md","bundlePath":"/downloads/typescript/helmet/v8-3-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/0_security_blueprint.md","blueprintPath":"/downloads/typescript/helmet/v8-3-0/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When initializing Helmet middleware or standalone sub-middleware functions and passing configuration objects and options.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/api-contract-misuse.md","path":"/downloads/typescript/helmet/v8-3-0/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When configuring Express server boundaries to control how untrusted third-party websites can embed and read application resources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/boundary-control.md","path":"/downloads/typescript/helmet/v8-3-0/boundary-control.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Configuring Content Security Policy in Helmet when an advanced edge case requires explicitly omitting the default-src fallback directive.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/escape-hatch.md","path":"/downloads/typescript/helmet/v8-3-0/escape-hatch.md"},{"slug":"injection","title":"Injection","description":"When configuring Content Security Policy directives in helmet to prevent script injection without enabling unsafe inline scripts.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/injection.md","path":"/downloads/typescript/helmet/v8-3-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When configuring cross-origin policy settings such as crossOriginOpenerPolicy to ensure allowed input values conform to explicit specifications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/input-contract-definition.md","path":"/downloads/typescript/helmet/v8-3-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring Content Security Policy directives using Helmet in an Express application to ensure reserved keywords are interpreted securely by browsers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/input-interpretation-safety.md","path":"/downloads/typescript/helmet/v8-3-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Use when configuring transport security headers and content security policies to prevent protocol downgrade attacks and ensure secure client communication.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/interface-protocol-hardening.md","path":"/downloads/typescript/helmet/v8-3-0/interface-protocol-hardening.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring the production runtime and process environment to reduce attack surface and avoid revealing framework implementation details.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/runtime-environment-hardening.md","path":"/downloads/typescript/helmet/v8-3-0/runtime-environment-hardening.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Registering Helmet as global middleware in an Express application to ensure security header controls remain consistently applied across all execution paths.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/security-control-integrity.md","path":"/downloads/typescript/helmet/v8-3-0/security-control-integrity.md"}]}]},{"slug":"hono","name":"Hono","latestVersion":"v4-12-32","versions":[{"version":"v4.12.32","versionSlug":"v4-12-32","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/hono/v4-12-32/","path":"/libraries/typescript/hono/v4-12-32/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32.md","bundlePath":"/downloads/typescript/hono/v4-12-32.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/0_security_blueprint.md","blueprintPath":"/downloads/typescript/hono/v4-12-32/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When restricting endpoint access by source IP addresses using allow lists and deny lists in Hono applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/access-control.md","path":"/downloads/typescript/hono/v4-12-32/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Building and configuring exception handlers, middleware stacks, and route logic to process runtime errors and authentication failures safely.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/api-contract-misuse.md","path":"/downloads/typescript/hono/v4-12-32/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Securing Hono endpoints with HTTP Basic Authentication or bearer tokens while preventing timing side-channels and unauthenticated access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/authentication.md","path":"/downloads/typescript/hono/v4-12-32/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Storing and retrieving per-request metadata and authentication state across Hono middleware boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/boundary-control.md","path":"/downloads/typescript/hono/v4-12-32/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Importing Hono modules into Deno runtimes for application development.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/configuration-source-integrity.md","path":"/downloads/typescript/hono/v4-12-32/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"When performing cryptographic operations, hashing, signature verification, or signing data using Hono utilities and Web Crypto APIs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/cryptography.md","path":"/downloads/typescript/hono/v4-12-32/cryptography.md"},{"slug":"csrf","title":"CSRF","description":"Building web applications or APIs with Hono where state-changing requests using ambient credentials require origin and request header validation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/csrf.md","path":"/downloads/typescript/hono/v4-12-32/csrf.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Rendering dynamic or user-provided HTML content via `dangerouslySetInnerHTML` in Hono JSX components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/escape-hatch.md","path":"/downloads/typescript/hono/v4-12-32/escape-hatch.md"},{"slug":"file-handling","title":"File Handling","description":"When configuring static file serving middleware or static site generation helpers to prevent unauthorized access and protect target output directories.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/file-handling.md","path":"/downloads/typescript/hono/v4-12-32/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Handling incoming JSON, form payloads, and localized language configurations where input validation and allowed structures must be strictly enforced.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/input-contract-definition.md","path":"/downloads/typescript/hono/v4-12-32/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Developing Hono applications that require secure routing boundaries, wildcard middleware paths, and sub-applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/input-driven-boundary-selection.md","path":"/downloads/typescript/hono/v4-12-32/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Extracting request metadata, parameters, and query strings in Hono where input dictionaries use prototype-less objects.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/input-interpretation-safety.md","path":"/downloads/typescript/hono/v4-12-32/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Enforcing HTTP response security headers, Content Security Policy directives, and secure nonce generation for inline scripts in Hono applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/interface-protocol-hardening.md","path":"/downloads/typescript/hono/v4-12-32/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When configuring IP restriction middleware to control network reachability based on client addresses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/network-boundary.md","path":"/downloads/typescript/hono/v4-12-32/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When combining styled utility classes with dynamic or external class strings in Hono applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/output-encoding.md","path":"/downloads/typescript/hono/v4-12-32/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Handling incoming HTTP requests and processing request bodies in Hono applications, particularly when deployed on serverless environments like AWS Lambda.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/resource-exhaustion.md","path":"/downloads/typescript/hono/v4-12-32/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When configuring authentication, environment variables, or platform secrets in Hono applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/secret-handling.md","path":"/downloads/typescript/hono/v4-12-32/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring cross-origin resource sharing (`cors`) or server-timing (`timing`) middleware headers for untrusted origins.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/security-control-integrity.md","path":"/downloads/typescript/hono/v4-12-32/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Use when configuring cookie-based session identifiers or handling session-related tokens in Hono routes to prevent session tampering and domain injection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/session-management.md","path":"/downloads/typescript/hono/v4-12-32/session-management.md"}]}]},{"slug":"mongoose","name":"Mongoose","latestVersion":"9-8-0","versions":[{"version":"9.8.0","versionSlug":"9-8-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/mongoose/9-8-0/","path":"/libraries/typescript/mongoose/9-8-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0.md","bundlePath":"/downloads/typescript/mongoose/9-8-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/0_security_blueprint.md","blueprintPath":"/downloads/typescript/mongoose/9-8-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When saving documents in Mongoose where updating existing records could bypass tenant ownership or authorization boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/access-control.md","path":"/downloads/typescript/mongoose/9-8-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When executing database transactions and handling modifications on partial or subdocument query results.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/api-contract-misuse.md","path":"/downloads/typescript/mongoose/9-8-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Establishing a database connection in Mongoose that requires user credentials and explicit authentication settings.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/authentication.md","path":"/downloads/typescript/mongoose/9-8-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Implementing deletion middleware or security hooks to ensure boundary checks execute correctly across document and query operations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/boundary-control.md","path":"/downloads/typescript/mongoose/9-8-0/boundary-control.md"},{"slug":"cryptography","title":"Cryptography","description":"Defining schemas with sensitive paths requiring cryptographic protection and initializing database connections with key management configurations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/cryptography.md","path":"/downloads/typescript/mongoose/9-8-0/cryptography.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"When performing update queries in Mongoose where untrusted input might otherwise be passed to `updatePipeline`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/dangerous-execution.md","path":"/downloads/typescript/mongoose/9-8-0/dangerous-execution.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"performing routine database operations and handling untrusted data to ensure schema validation, type casting, and middleware hooks remain enforced","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/escape-hatch.md","path":"/downloads/typescript/mongoose/9-8-0/escape-hatch.md"},{"slug":"injection","title":"Injection","description":"Building Mongoose queries or aggregation pipelines using user-supplied input where unvalidated structures or concatenated strings can lead to injection.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/injection.md","path":"/downloads/typescript/mongoose/9-8-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining schemas and processing external input payloads to prevent mass assignment and ensure valid data types, enums, ranges, and required properties.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/input-contract-definition.md","path":"/downloads/typescript/mongoose/9-8-0/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"When defining schemas that use dynamic document references via `refPath` to populate documents from untrusted sources.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/input-driven-boundary-selection.md","path":"/downloads/typescript/mongoose/9-8-0/input-driven-boundary-selection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Handling untrusted user inputs or query parameters in Mongoose schemas, queries, and validation workflows.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/input-interpretation-safety.md","path":"/downloads/typescript/mongoose/9-8-0/input-interpretation-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring database cluster network connections and firewall rules to restrict network access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/network-boundary.md","path":"/downloads/typescript/mongoose/9-8-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Developing database queries and operations that require protection against unbounded execution times and denial-of-service conditions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/resource-exhaustion.md","path":"/downloads/typescript/mongoose/9-8-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring database connections and handling connection failures during application startup and runtime.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/runtime-environment-hardening.md","path":"/downloads/typescript/mongoose/9-8-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring database connections and defining schema projections in Mongoose.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/secret-handling.md","path":"/downloads/typescript/mongoose/9-8-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When configuring schema options, query update filters, and discriminator models to prevent unauthorized data modifications and control bypasses.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/security-control-integrity.md","path":"/downloads/typescript/mongoose/9-8-0/security-control-integrity.md"}]}]},{"slug":"nest","name":"Nest","latestVersion":"v11-1-28","versions":[{"version":"v11.1.28","versionSlug":"v11-1-28","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/nest/v11-1-28/","path":"/libraries/typescript/nest/v11-1-28/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28.md","bundlePath":"/downloads/typescript/nest/v11-1-28.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/0_security_blueprint.md","blueprintPath":"/downloads/typescript/nest/v11-1-28/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Implementing role-based authorization, guard binding, or tenant context that varies between incoming requests.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/access-control.md","path":"/downloads/typescript/nest/v11-1-28/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When documenting NestJS APIs using OpenAPI (Swagger) decorators such as `@ApiSecurity` or `@ApiBearerAuth`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/api-contract-misuse.md","path":"/downloads/typescript/nest/v11-1-28/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Implementing JWT-based token authentication, route guards, and custom header parsing in NestJS applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/authentication.md","path":"/downloads/typescript/nest/v11-1-28/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Designing error-handling policies and configuring exception filters in NestJS applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/boundary-control.md","path":"/downloads/typescript/nest/v11-1-28/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring monorepo tooling scripts, managing external dependencies, or querying package metadata during build or initialization in NestJS applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/configuration-source-integrity.md","path":"/downloads/typescript/nest/v11-1-28/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Implementing user authentication and credential verification workflows in a NestJS application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/cryptography.md","path":"/downloads/typescript/nest/v11-1-28/cryptography.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"A request supplies an expression, formula, filter, or template that a controller, service, or pipe computes a result from.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/dangerous-execution.md","path":"/downloads/typescript/nest/v11-1-28/dangerous-execution.md"},{"slug":"file-handling","title":"File Handling","description":"When configuring static asset hosting within a NestJS application using @nestjs/serve-static.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/file-handling.md","path":"/downloads/typescript/nest/v11-1-28/file-handling.md"},{"slug":"injection","title":"Injection","description":"When querying or mutating database records with TypeORM in NestJS services.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/injection.md","path":"/downloads/typescript/nest/v11-1-28/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining incoming request shapes and DTOs for NestJS HTTP endpoints and GraphQL resolvers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/input-contract-definition.md","path":"/downloads/typescript/nest/v11-1-28/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Configuring route-level security middleware and authorization policies in NestJS applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/input-interpretation-safety.md","path":"/downloads/typescript/nest/v11-1-28/input-interpretation-safety.md"},{"slug":"network-boundary","title":"Network Boundary","description":"When bootstrapping a NestJS application and launching the HTTP listener using NestFactory.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/network-boundary.md","path":"/downloads/typescript/nest/v11-1-28/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"Returning request-derived or stored text inside an HTML response body, or rendering a view with values that originated from a client.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/output-encoding.md","path":"/downloads/typescript/nest/v11-1-28/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Implementing Server-Sent Events (SSE) or managing persistent connections in NestJS applications using Express or Fastify.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/resource-exhaustion.md","path":"/downloads/typescript/nest/v11-1-28/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Bootstrapping a NestJS application using `@nestjs/core` and governing runtime modes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/runtime-environment-hardening.md","path":"/downloads/typescript/nest/v11-1-28/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring modules, database providers, or authentication handlers in NestJS that require sensitive credentials or cryptographic keys.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/secret-handling.md","path":"/downloads/typescript/nest/v11-1-28/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When configuring routing-level security controls, including middleware binders, routing prefixes, path exclusions, and multi-method routing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/security-control-integrity.md","path":"/downloads/typescript/nest/v11-1-28/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"When implementing a custom provider whose lifetime must be tied to one incoming request.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/session-management.md","path":"/downloads/typescript/nest/v11-1-28/session-management.md"}]}]},{"slug":"prisma","name":"Prisma","latestVersion":"7-8-0","versions":[{"version":"7.8.0","versionSlug":"7-8-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/prisma/7-8-0/","path":"/libraries/typescript/prisma/7-8-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0.md","bundlePath":"/downloads/typescript/prisma/7-8-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/0_security_blueprint.md","blueprintPath":"/downloads/typescript/prisma/7-8-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"When implementing data access logic in applications using Prisma, especially for operations that modify or retrieve sensitive information.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/access-control.md","path":"/downloads/typescript/prisma/7-8-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Executing database operations within Prisma's interactive transactions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/api-contract-misuse.md","path":"/downloads/typescript/prisma/7-8-0/api-contract-misuse.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Setting up Prisma migrations, managing database credentials, or configuring the migration environment.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/configuration-source-integrity.md","path":"/downloads/typescript/prisma/7-8-0/configuration-source-integrity.md"},{"slug":"cryptography","title":"Cryptography","description":"Using cryptographic functions like hashing or random number generation within your application, especially when leveraging Prisma's compatibility layers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/cryptography.md","path":"/downloads/typescript/prisma/7-8-0/cryptography.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"When executing raw SQL queries or commands directly against the database.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/dangerous-execution.md","path":"/downloads/typescript/prisma/7-8-0/dangerous-execution.md"},{"slug":"injection","title":"Injection","description":"When interacting with the database using Prisma Client, especially when constructing queries with user-provided data.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/injection.md","path":"/downloads/typescript/prisma/7-8-0/injection.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When manually constructing query plans or extensions in Prisma Client, especially when dealing with specialized data types.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/input-interpretation-safety.md","path":"/downloads/typescript/prisma/7-8-0/input-interpretation-safety.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Initializing PrismaClient in Prisma version 7.8.0.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/interface-protocol-hardening.md","path":"/downloads/typescript/prisma/7-8-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring Prisma Client to connect to a database, especially when using HTTP-based adapters or custom network configurations.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/network-boundary.md","path":"/downloads/typescript/prisma/7-8-0/network-boundary.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When querying data with Prisma, especially for large datasets or complex relationships.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/resource-exhaustion.md","path":"/downloads/typescript/prisma/7-8-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"When developing or deploying applications using Prisma, especially in production environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/runtime-environment-hardening.md","path":"/downloads/typescript/prisma/7-8-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring database connections or other sensitive settings in Prisma, especially after version 7.0.0.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/secret-handling.md","path":"/downloads/typescript/prisma/7-8-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When performing sensitive database operations that require strict data consistency and atomicity, especially within transactions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/security-control-integrity.md","path":"/downloads/typescript/prisma/7-8-0/security-control-integrity.md"}]}]},{"slug":"sequelize","name":"Sequelize","latestVersion":"v6-37-8","versions":[{"version":"v6.37.8","versionSlug":"v6-37-8","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/sequelize/v6-37-8/","path":"/libraries/typescript/sequelize/v6-37-8/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8.md","bundlePath":"/downloads/typescript/sequelize/v6-37-8.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/0_security_blueprint.md","blueprintPath":"/downloads/typescript/sequelize/v6-37-8/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Querying associated records across `belongsToMany` relationships where tenant isolation or ownership checks must be applied to the intermediate join table metadata.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/access-control.md","path":"/downloads/typescript/sequelize/v6-37-8/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"When managing database transactions and ensuring transaction handles or query methods are invoked within valid lifecycle boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/api-contract-misuse.md","path":"/downloads/typescript/sequelize/v6-37-8/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"Registering post-commit callbacks on transaction instances using Sequelize","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/boundary-control.md","path":"/downloads/typescript/sequelize/v6-37-8/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Instantiating Sequelize with database connection parameters where connection string parsing might allow untrusted input to override security settings.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/configuration-source-integrity.md","path":"/downloads/typescript/sequelize/v6-37-8/configuration-source-integrity.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Building queries using Sequelize low-level literal escape hatches or custom raw query expressions where untrusted user input might be passed.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/escape-hatch.md","path":"/downloads/typescript/sequelize/v6-37-8/escape-hatch.md"},{"slug":"injection","title":"Injection","description":"When querying JSON columns, filtering paths, or executing DDL and metadata operations involving dynamic table or column identifiers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/injection.md","path":"/downloads/typescript/sequelize/v6-37-8/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining Sequelize models, data types, associations, and instance options where untrusted input must conform to strict schema boundaries before execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/input-contract-definition.md","path":"/downloads/typescript/sequelize/v6-37-8/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"When supplying replacement maps for named parameters in raw SQL queries to ensure keys resolve strictly to own properties.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/input-interpretation-safety.md","path":"/downloads/typescript/sequelize/v6-37-8/input-interpretation-safety.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring database connections and handling large query results in Sequelize to prevent memory exhaustion and Denial of Service.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/resource-exhaustion.md","path":"/downloads/typescript/sequelize/v6-37-8/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Configuring application initialization and database connection logic for deployment environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/runtime-environment-hardening.md","path":"/downloads/typescript/sequelize/v6-37-8/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring database connection credentials and defining model attributes in Sequelize applications.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/secret-handling.md","path":"/downloads/typescript/sequelize/v6-37-8/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"When performing bulk inserts, upserts, validations, or soft deletes on Sequelize models where lifecycle hooks and model validation checks could otherwise be bypassed.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/sequelize/v6-37-8/security-control-integrity.md","path":"/downloads/typescript/sequelize/v6-37-8/security-control-integrity.md"}]}]},{"slug":"trpc","name":"Trpc","latestVersion":"v11-18-0","versions":[{"version":"v11.18.0","versionSlug":"v11-18-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/trpc/v11-18-0/","path":"/libraries/typescript/trpc/v11-18-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0.md","bundlePath":"/downloads/typescript/trpc/v11-18-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/0_security_blueprint.md","blueprintPath":"/downloads/typescript/trpc/v11-18-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Developing tRPC procedures that require verification of organization membership, role assignment, or resource ownership before granting access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/access-control.md","path":"/downloads/typescript/trpc/v11-18-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Configuring the tRPC client links array for network dispatch and middleware execution.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/api-contract-misuse.md","path":"/downloads/typescript/trpc/v11-18-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Configuring context creation for incoming HTTP requests, WebSocket connections, or serverless adapters to ensure caller identity is cryptographically verified on every request.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/authentication.md","path":"/downloads/typescript/trpc/v11-18-0/authentication.md"},{"slug":"deserialization","title":"Deserialization","description":"Configuring request serialization and deserialization across the tRPC API boundary between server procedures and client links.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/deserialization.md","path":"/downloads/typescript/trpc/v11-18-0/deserialization.md"},{"slug":"file-handling","title":"File Handling","description":"Developing tRPC procedures and client mutations that accept `FormData`, binary streams, or files.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/file-handling.md","path":"/downloads/typescript/trpc/v11-18-0/file-handling.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Building and securing tRPC queries, mutations, or subscription procedures that accept untrusted client inputs.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/input-contract-definition.md","path":"/downloads/typescript/trpc/v11-18-0/input-contract-definition.md"},{"slug":"input-driven-boundary-selection","title":"Input Driven Boundary Selection","description":"Configuring tRPC request handlers, standalone adapters, and HTTP method route exports to ensure proper path routing and request validation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/input-driven-boundary-selection.md","path":"/downloads/typescript/trpc/v11-18-0/input-driven-boundary-selection.md"},{"slug":"interface-protocol-hardening","title":"Interface Protocol Hardening","description":"Configuring transport adapters and handlers such as `createHTTPServer` or Next.js integrations where security headers and cross-origin policies are not applied automatically.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/interface-protocol-hardening.md","path":"/downloads/typescript/trpc/v11-18-0/interface-protocol-hardening.md"},{"slug":"network-boundary","title":"Network Boundary","description":"Configuring standalone or HTTP adapters for tRPC to handle cross-origin requests securely across network boundaries.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/network-boundary.md","path":"/downloads/typescript/trpc/v11-18-0/network-boundary.md"},{"slug":"output-encoding","title":"Output Encoding","description":"implementing a custom Devalue data transformer for serialization and deserialization","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/output-encoding.md","path":"/downloads/typescript/trpc/v11-18-0/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring tRPC client links and server WebSocket handlers to protect finite server resources against unbounded batching, zombie connections, and leaked subscription event listeners.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/resource-exhaustion.md","path":"/downloads/typescript/trpc/v11-18-0/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"initializing the tRPC server router and configuring runtime environment options for production deployment.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/runtime-environment-hardening.md","path":"/downloads/typescript/trpc/v11-18-0/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"Configuring client links like `httpSubscriptionLink` or setting up Server-Sent Events subscriptions that require authentication.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/secret-handling.md","path":"/downloads/typescript/trpc/v11-18-0/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Configuring tRPC client links using `splitLink` to branch request execution based on operation context or conditions.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/security-control-integrity.md","path":"/downloads/typescript/trpc/v11-18-0/security-control-integrity.md"},{"slug":"session-management","title":"Session Management","description":"Configuring client links, Server-Side Rendering (SSR), or cross-domain subscriptions where session cookies must be correctly forwarded, sent across origins, or modified.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/trpc/v11-18-0/session-management.md","path":"/downloads/typescript/trpc/v11-18-0/session-management.md"}]}]},{"slug":"type-orm","name":"Type Orm","latestVersion":"1-1-0","versions":[{"version":"1.1.0","versionSlug":"1-1-0","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/type-orm/1-1-0/","path":"/libraries/typescript/type-orm/1-1-0/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0.md","bundlePath":"/downloads/typescript/type-orm/1-1-0.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/0_security_blueprint.md","blueprintPath":"/downloads/typescript/type-orm/1-1-0/0_security_blueprint.md","categories":[{"slug":"access-control","title":"Access Control","description":"Configuring database connections in applications where write access is not required or should be restricted to enforce tenant isolation and least privilege access.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/access-control.md","path":"/downloads/typescript/type-orm/1-1-0/access-control.md"},{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Calling TypeORM repository, entity manager, query builder, and transaction methods where specific arguments, types, call orders, criteria objects, and lock options are required.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/api-contract-misuse.md","path":"/downloads/typescript/type-orm/1-1-0/api-contract-misuse.md"},{"slug":"authentication","title":"Authentication","description":"Configuring database connections and authentication options in TypeORM for enterprise or cloud-hosted environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/authentication.md","path":"/downloads/typescript/type-orm/1-1-0/authentication.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When performing queries that evaluate access control checks or rely on recently written state in a replicated database environment.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/boundary-control.md","path":"/downloads/typescript/type-orm/1-1-0/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Initializing TypeORM DataSource configurations for production and development environments.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/configuration-source-integrity.md","path":"/downloads/typescript/type-orm/1-1-0/configuration-source-integrity.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"Configuring MongoDB database connections using `DataSource` in TypeORM.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/dangerous-execution.md","path":"/downloads/typescript/type-orm/1-1-0/dangerous-execution.md"},{"slug":"injection","title":"Injection","description":"When configuring parameter maps or object literals for database query execution across TypeORM drivers.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/injection.md","path":"/downloads/typescript/type-orm/1-1-0/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"When validating entity attributes and enforcing schema constraints using class-validator before saving data to the database using TypeORM.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/input-contract-definition.md","path":"/downloads/typescript/type-orm/1-1-0/input-contract-definition.md"},{"slug":"input-interpretation-safety","title":"Input Interpretation Safety","description":"Writing input validation logic before persisting data into simple-array columns in TypeORM entities.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/input-interpretation-safety.md","path":"/downloads/typescript/type-orm/1-1-0/input-interpretation-safety.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"Configuring database connections and executing queries in TypeORM to bound execution time and prevent resource starvation.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/resource-exhaustion.md","path":"/downloads/typescript/type-orm/1-1-0/resource-exhaustion.md"},{"slug":"secret-handling","title":"Secret Handling","description":"When defining entity columns that store sensitive data or when configuring connection URLs with special characters.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/secret-handling.md","path":"/downloads/typescript/type-orm/1-1-0/secret-handling.md"}]}]},{"slug":"vue","name":"Vue","latestVersion":"v3-5-40","versions":[{"version":"v3.5.40","versionSlug":"v3-5-40","canonicalUrl":"https://securitycards.rewarelabs.com/libraries/typescript/vue/v3-5-40/","path":"/libraries/typescript/vue/v3-5-40/","bundleUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40.md","bundlePath":"/downloads/typescript/vue/v3-5-40.md","blueprintUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/0_security_blueprint.md","blueprintPath":"/downloads/typescript/vue/v3-5-40/0_security_blueprint.md","categories":[{"slug":"api-contract-misuse","title":"API Contract Misuse","description":"Developing computed properties for derived state in Vue components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/api-contract-misuse.md","path":"/downloads/typescript/vue/v3-5-40/api-contract-misuse.md"},{"slug":"boundary-control","title":"Boundary Control","description":"When updating component data or passing state modifications from a child component back up to a parent component across the component state boundary.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/boundary-control.md","path":"/downloads/typescript/vue/v3-5-40/boundary-control.md"},{"slug":"configuration-source-integrity","title":"Configuration Source Integrity","description":"Configuring production bundlers and build workflows for Vue applications to prevent exposing development tooling, internal devtools hooks, or raw source maps.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/configuration-source-integrity.md","path":"/downloads/typescript/vue/v3-5-40/configuration-source-integrity.md"},{"slug":"dangerous-execution","title":"Dangerous Execution","description":"When defining component templates using Vue APIs such as `Vue.createApp({ template: ... })`.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/dangerous-execution.md","path":"/downloads/typescript/vue/v3-5-40/dangerous-execution.md"},{"slug":"escape-hatch","title":"Escape Hatch","description":"Rendering dynamic or user-supplied content inside Vue component templates where raw HTML injection could occur.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/escape-hatch.md","path":"/downloads/typescript/vue/v3-5-40/escape-hatch.md"},{"slug":"injection","title":"Injection","description":"Building dynamic styles and applying CSS properties using Vue style bindings","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/injection.md","path":"/downloads/typescript/vue/v3-5-40/injection.md"},{"slug":"input-contract-definition","title":"Input Contract Definition","description":"Defining and validating component boundaries such as props and emitted events to reject malformed or out-of-contract input before application processing.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/input-contract-definition.md","path":"/downloads/typescript/vue/v3-5-40/input-contract-definition.md"},{"slug":"output-encoding","title":"Output Encoding","description":"When rendering dynamic attributes like `:href` in Vue templates using untrusted data that may contain unsafe URL schemes.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/output-encoding.md","path":"/downloads/typescript/vue/v3-5-40/output-encoding.md"},{"slug":"resource-exhaustion","title":"Resource Exhaustion","description":"When processing large data structures or arrays of deeply nested objects in Vue components to prevent CPU and memory exhaustion.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/resource-exhaustion.md","path":"/downloads/typescript/vue/v3-5-40/resource-exhaustion.md"},{"slug":"runtime-environment-hardening","title":"Runtime Environment Hardening","description":"Deploying Vue applications to production environments or configuring build pipelines.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/runtime-environment-hardening.md","path":"/downloads/typescript/vue/v3-5-40/runtime-environment-hardening.md"},{"slug":"secret-handling","title":"Secret Handling","description":"persisting non-sensitive UI settings or application state in browser storage such as `localStorage` or `sessionStorage` in a Vue application.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/secret-handling.md","path":"/downloads/typescript/vue/v3-5-40/secret-handling.md"},{"slug":"security-control-integrity","title":"Security Control Integrity","description":"Exposing reactive state through Vue's `provide()` mechanism to descendant components.","canonicalUrl":"https://securitycards.rewarelabs.com/downloads/typescript/vue/v3-5-40/security-control-integrity.md","path":"/downloads/typescript/vue/v3-5-40/security-control-integrity.md"}]}]}]}]}