# Security Cards Catalog > Complete machine-readable inventory for Security Cards by RewareLabs. Canonical catalog: https://securitycards.rewarelabs.com/llms.txt Platform usage guide: https://securitycards.rewarelabs.com/security-cards.md Supported inventory: 10 languages, 49 libraries, 49 library versions, and 728 category files. ## Usage - Prefer the narrowest canonical URL that covers the task. - Library and card URLs are version-pinned. - An unavailable or malformed version redirects to the latest supported version for the exact language and library. ## Languages - [C#](https://securitycards.rewarelabs.com/llms/c%23.txt) - [Go](https://securitycards.rewarelabs.com/llms/go.txt) - [Java](https://securitycards.rewarelabs.com/llms/java.txt) - [JavaScript](https://securitycards.rewarelabs.com/llms/javascript.txt) - [PHP](https://securitycards.rewarelabs.com/llms/php.txt) - [Python](https://securitycards.rewarelabs.com/llms/python.txt) - [Ruby](https://securitycards.rewarelabs.com/llms/ruby.txt) - [Rust](https://securitycards.rewarelabs.com/llms/rust.txt) - [Swift](https://securitycards.rewarelabs.com/llms/swift.txt) - [TypeScript](https://securitycards.rewarelabs.com/llms/typescript.txt) ## C# Language catalog: https://securitycards.rewarelabs.com/llms/c%23.txt All C# cards: https://securitycards.rewarelabs.com/downloads/c%23.md ### Asp Net v10.0.10 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/c%23/asp-net/v10-0-10/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/access-control.md): When designing or configuring application-wide authorization defaults to ensure unannotated endpoints and default policy checks enforce secure access control standards. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/api-contract-misuse.md): Configuring cookie authentication options and session lifetimes in ASP.NET Core applications. - [Authentication](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/authentication.md): Setting up inbound JWT bearer authentication, OpenID Connect flows, or WS-Federation token handlers that require cryptographic verification of signatures, issuers, and audiences. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/boundary-control.md): Developing single-page applications or Blazor components that handle client-side deep links, navigation targets, and unmapped route parameters. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/configuration-source-integrity.md): Binding authentication, WS-Federation, JWT bearer token validation options, or Kestrel configurations from external or file-based configuration providers. - [Cryptography](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/cryptography.md): Configuring cryptographic algorithms, encryption mechanisms, and exception handling for data protection and payload encryption. - [CSRF](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/csrf.md): Configuring authentication handlers, remote identity providers, or processing state-changing form submissions in ASP.NET Core applications. - [Deserialization](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/deserialization.md): Configuring state parameter serialization and deserialization in `OpenIdConnectHandler` for callback requests. - [File Handling](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/file-handling.md): Exporting and persisting HTTPS certificates or private key files onto disk storage. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/input-contract-definition.md): Use when binding user requests to controllers or minimal APIs, updating models via `TryUpdateModelAsync`, or validating hierarchical and complex model properties. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/input-interpretation-safety.md): When performing user or role lookups within ASP.NET Core Identity to ensure string representations are consistently normalized. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/interface-protocol-hardening.md): Configuring JWT bearer authentication events to extract access tokens from query string parameters for specific network protocols like WebSockets or Server-Sent Events. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/network-boundary.md): Configuring WS-Federation authentication options in production environments to retrieve signing keys and metadata securely. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/output-encoding.md): When writing untrusted data or request query parameters directly into HTTP HTML response bodies in custom middleware or endpoint handlers. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/resource-exhaustion.md): Configuring connection handlers and buffer thresholds in ASP.NET applications to enforce backpressure against slow or malicious clients. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/runtime-environment-hardening.md): Configuring custom error handlers or authentication event hooks where raw exception details might otherwise be exposed to callers. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/secret-handling.md): Handling temporary key derivation buffers, XML secret arrays, temporary certificate files, and authentication tokens in ASP.NET Core. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/security-control-integrity.md): When managing user authentication tickets, session validation, principal refreshing, or updating identity features during request processing. - [Session Management](https://securitycards.rewarelabs.com/downloads/c%23/asp-net/v10-0-10/session-management.md): When configuring authentication cookies, cookie security policies, and server-side ticket storage for sessions. ## Go Language catalog: https://securitycards.rewarelabs.com/llms/go.txt All Go cards: https://securitycards.rewarelabs.com/downloads/go.md ### Beego v2.3.10 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/go/beego/v2-3-10/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/access-control.md): Configuring Cross-Origin Resource Sharing (`CORS`) filters for web applications or API routes using `beego`. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/api-contract-misuse.md): When building database queries and propagating request contexts in Beego ORM. - [Authentication](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/authentication.md): When validating incoming API requests using shared secrets and timestamps to verify client identity and prevent unauthorized requests. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/configuration-source-integrity.md): Loading YAML or JSON configuration files into Beego applications where environment variable interpolation is evaluated. - [Cryptography](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/cryptography.md): Configuring or encoding session cookies and implementing cryptographic key management within Beego applications. - [CSRF](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/csrf.md): When developing state-changing web endpoints using Beego controllers and handlers that require Cross-Site Request Forgery protection. - [Deserialization](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/deserialization.md): When storing and retrieving custom struct types in Beego session providers that utilize `gob` encoding and decoding. - [File Handling](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/file-handling.md): When handling user input or uploaded filenames in controller operations, file downloads, or file attachments. - [Injection](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/injection.md): Building database queries, raw SQL statements, or query builder expressions using Beego ORM. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/input-contract-definition.md): When validating untrusted incoming request data and struct objects against strict type, range, and format rules before processing them in application logic. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/input-interpretation-safety.md): Extracting and utilizing route parameters, query strings, or request payloads in Beego applications where automated decoding or interpretation boundaries apply. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/output-encoding.md): When configuring HTTP settings or serializing JSON payloads via `httplib` that may be rendered in web interfaces or HTML templates. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/resource-exhaustion.md): Configuring web application server parameters or handling incoming request payloads in Beego to protect against memory exhaustion and denial-of-service vulnerabilities. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/runtime-environment-hardening.md): Deploying the Beego application to production environments where sensitive internals, error traces, and SQL debugging output must be hidden from end-users. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/secret-handling.md): Configuring database connection strings, session providers, cache stores, logging targets, or configuration files that require sensitive credentials and authentication secrets. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/security-control-integrity.md): Registering access control, authentication, or input validation filters via `InsertFilter` where writing an error status code or response body must immediately halt downstream request processing. - [Session Management](https://securitycards.rewarelabs.com/downloads/go/beego/v2-3-10/session-management.md): Configuring session providers and cookie security attributes for web applications and API endpoints. ### Chi v5.3.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/go/chi/v5-3-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/access-control.md): When organizing routes in Chi and securing endpoints against unauthorized actions or cross-user access - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/api-contract-misuse.md): Integrating Chi routers, middleware components, and custom HTTP method handlers into a Go application. - [Authentication](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/authentication.md): Developing authentication middleware to verify user identity before storing session or user state in the request context. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/boundary-control.md): Setting up boundary trust verification and client IP retrieval using middleware.ClientIPFromHeader in chi applications behind a reverse proxy. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/input-driven-boundary-selection.md): When routing middleware execution using `middleware.RouteHeaders()` to apply security checks or access controls based on untrusted request headers. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/input-interpretation-safety.md): When building HTTP routers and handling URL parameters, path extensions, or request path normalization in Chi - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/interface-protocol-hardening.md): When registering endpoints and configuring routers to ensure requests strictly adhere to expected HTTP methods and protocol semantics. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/network-boundary.md): Setting up HTTP routers behind reverse proxies or load balancers where client IP addresses must be securely resolved without falling back to vulnerable default header parsing. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/resource-exhaustion.md): When building endpoints or route groups that accept client payloads or execute resource-intensive operations and require protection against resource exhaustion and Denial of Service. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/secret-handling.md): When building HTTP endpoints and configuring logging middleware with chi to prevent plaintext exposure of secrets in request URIs. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/go/chi/v5-3-1/security-control-integrity.md): When registering global middleware, constructing middleware chains, or setting up routing middleware in Chi applications to ensure security mechanisms execute reliably. ### Fiber v3.4.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/go/fiber/v3-4-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/access-control.md): Implementing authentication or access control middleware in a Fiber route chain to protect endpoints against unauthorized access. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/api-contract-misuse.md): Parsing and binding incoming request data using `c.Bind()`. - [Authentication](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/authentication.md): When configuring authentication mechanisms such as basic authentication or key-based token validation in Fiber applications. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/boundary-control.md): When implementing HTTP redirection back to the originating request context using `c.Redirect().Back()`. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/configuration-source-integrity.md): Configuring server TLS parameters and certificate management options in ListenConfig to ensure deterministic and unambiguous security configuration precedence. - [CSRF](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/csrf.md): When protecting state-changing routes against cross-site request forgery using Fiber's CSRF middleware and extractors. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/escape-hatch.md): Integrating net/http handlers with Fiber and propagating request context. - [File Handling](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/file-handling.md): Handling user input to serve or access files via `c.Download()`, `c.SendFile()`, or custom path resolution. - [Injection](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/injection.md): When accepting dynamic sort parameters from user-driven query strings for database sorting in Fiber applications. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/input-contract-definition.md): Use when binding and validating incoming request parameters, query strings, headers, or body payloads to ensure input conforms to expected types, structures, and required field criteria before process… - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/input-driven-boundary-selection.md): Handling user-supplied query parameters or HTTP headers to determine redirect destinations in Fiber route handlers. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/input-interpretation-safety.md): When configuring application routing paths or binding request parameters where inconsistent decoding or ambiguous parameter origins could lead to alternate interpretations. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/interface-protocol-hardening.md): When configuring Fiber application routing, global configurations, and middleware to process incoming HTTP requests strictly according to expected methods and content semantics. - [Memory Safety](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/memory-safety.md): When handling requests, passing context values or header slices to background goroutines, or retaining parsed data beyond request handler execution in Fiber. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/network-boundary.md): When deploying Fiber applications behind reverse proxies, load balancers, or when configuring server network and transport security settings. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/output-encoding.md): When populating `RedirectConfig.Queries` with untrusted data for `c.Redirect().Route()` in Fiber applications. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/resource-exhaustion.md): When initializing Fiber applications and handling incoming HTTP requests or background operations that require strict bounds on payload size and execution time. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/runtime-environment-hardening.md): Configuring Fiber runtime execution mode for production deployment to manage socket reuse and process isolation. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/secret-handling.md): Configuring encryption keys and ensuring proper value redaction in Fiber middleware components. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/security-control-integrity.md): When initializing application middleware and setting up global security controls in Fiber to ensure protections remain enabled, correctly ordered, and consistently applied across all execution paths i… - [Session Management](https://securitycards.rewarelabs.com/downloads/go/fiber/v3-4-0/session-management.md): Use when managing session lifecycles, setting expiration limits, and interacting with request context sessions. ### Gin v1.12.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/go/gin/v1-12-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/access-control.md): When implementing authentication or authorization middleware in Gin to prevent unauthorized actions and enforce access control. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/api-contract-misuse.md): When rendering redirects using `render.Redirect` within a Gin application. - [Authentication](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/authentication.md): Implementing credential verification and establishing user identity for protected HTTP routes using built-in authentication middleware. - [CSRF](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/csrf.md): Setting session or authentication cookies using `gin.Context` for stateful web applications. - [File Handling](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/file-handling.md): Handling file uploads from multipart forms in Gin handlers and saving them to the local filesystem. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/input-contract-definition.md): Handling incoming HTTP request payloads or path parameters and enforcing required fields, types, and input constraints. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/input-interpretation-safety.md): When routing needs to evaluate raw percent-encoded request paths rather than unescaped paths to prevent validation and policy bypass. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/interface-protocol-hardening.md): Configuring reverse proxy boundaries and managing incoming request forwarding headers in Gin applications. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/network-boundary.md): Configuring trusted upstream proxies or load balancers for Gin routers to accurately parse client IP headers. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/output-encoding.md): When serving JSON payloads that may be embedded directly inside HTML templates or web view contexts. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/resource-exhaustion.md): Processing multipart form uploads in Gin applications to prevent memory exhaustion and Denial of Service. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/runtime-environment-hardening.md): initializing the Gin application engine for a production environment to disable internal debugging outputs. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/secret-handling.md): Configuring request logging and panic recovery middleware to prevent sensitive credentials, tokens, and query parameters from appearing in log outputs. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/security-control-integrity.md): When configuring panic recovery middleware in Gin applications to ensure clean error handling and prevent uncontrolled status code overwrites. - [Session Management](https://securitycards.rewarelabs.com/downloads/go/gin/v1-12-0/session-management.md): When issuing session cookies using Gin's `Context.SetCookie` and `Context.SetSameSite` methods. ### Gorm v1.31.2 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/go/gorm/v1-31-2/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/access-control.md): Use when querying, updating, or deleting records to ensure that unauthorized actors cannot bypass soft-delete boundaries, expose sensitive fields, or execute unconstrained destructive queries. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/api-contract-misuse.md): When executing row scans with GORM's `Scan` API and utilizing the returned results in authorization, authentication, or business logic. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/boundary-control.md): Persisting structs with relationships such as `BelongsTo`, `HasOne`, `HasMany`, or `Many2Many` using untrusted input. - [Deserialization](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/deserialization.md): When implementing custom field serializers using `schema.RegisterSerializer` or custom `Scanner` types where database values are received as empty interfaces. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/escape-hatch.md): When constructing database queries dynamically where table or column names might be influenced by user input. - [Injection](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/injection.md): When building query clauses, raw statements, custom valuers, associations, or joins where dynamic or untrusted input is included in database operations. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/input-contract-definition.md): When creating database records from user-controlled input structs or maps to enforce input structure and field boundaries. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/resource-exhaustion.md): Configuring GORM database instances and executing queries that require bounds on execution time or connection duration. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/secret-handling.md): When configuring GORM loggers or implementing custom loggers to prevent the exposure of secrets, tokens, and personal data in query execution logs. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/go/gorm/v1-31-2/security-control-integrity.md): Use when performing model updates, deletions, or session configurations where lifecycle hooks enforce critical security validations, audit logging, or field transformations. ## Java Language catalog: https://securitycards.rewarelabs.com/llms/java.txt All Java cards: https://securitycards.rewarelabs.com/downloads/java.md ### Quarkus 3.38.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/java/quarkus/3-38-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/access-control.md): Configuring Kubernetes RBAC permissions and role bindings using Quarkus deployment properties for application workloads. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/api-contract-misuse.md): When registering custom OpenAPI filters to sanitize or adjust API schemas using Quarkus smallrye-openapi. - [Authentication](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/authentication.md): Implementing WebAuthn multi-factor authentication or binding access tokens to client certificates in mTLS environments. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/boundary-control.md): Configuring OpenTelemetry tracing, span attributes, exporters, and telemetry endpoints in Quarkus applications. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/configuration-source-integrity.md): Configuring security controls in Quarkus using both configuration files and programmatic builders simultaneously. - [Cryptography](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/cryptography.md): You are implementing user registration or credential update workflows where passwords must be securely hashed prior to storage. - [CSRF](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/csrf.md): Building web forms or REST endpoints in Quarkus that handle state-changing browser requests using ambient credentials and require anti-CSRF token protection. - [Deserialization](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/deserialization.md): Deserializing untrusted incoming data streams such as Kafka records or JSON payloads in Quarkus applications. - [File Handling](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/file-handling.md): When configuring local filesystem static file paths and endpoints in Quarkus applications to serve web resources securely. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/input-driven-boundary-selection.md): Implementing custom tenant resolution via `TenantResolver` or `TenantConfigResolver` in a Quarkus OIDC multi-tenancy application. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/interface-protocol-hardening.md): Configuring network transport schemes and protocol versions for WebSocket communication in production environments. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/network-boundary.md): Configuring outbound REST client connections, OIDC integration, and Keycloak policy enforcer endpoints that communicate across network trust boundaries. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/resource-exhaustion.md): Configuring OIDC bearer token authentication in Quarkus applications to handle remote token introspection and UserInfo endpoint responses efficiently. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/runtime-environment-hardening.md): Developing or packaging Quarkus applications as GraalVM native images where dynamic reflection, native initialization, and proxy configurations are required. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/secret-handling.md): When configuring authentication client secrets, database passwords, SSL key store passwords, and third-party service credentials in Quarkus applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/security-control-integrity.md): Configuring incoming Kafka messaging consumers in Quarkus to protect against resource exhaustion caused by unacknowledged records. - [Session Management](https://securitycards.rewarelabs.com/downloads/java/quarkus/3-38-0/session-management.md): Configuring session cookies and form authentication in Quarkus web applications to protect authentication state against cross-site scripting and unauthorized interception. ### Shiro shiro.root.3.0.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/java/shiro/shiro-root-3-0-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/access-control.md): When defining wildcard permissions, setting up role permission resolvers, or configuring case sensitivity for resource identifiers. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/api-contract-misuse.md): When configuring realms, filters, session management, and authentication tokens in Apache Shiro applications to prevent API contract violations and runtime exceptions. - [Authentication](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/authentication.md): Authorizing sensitive operations and managing authenticated versus remembered user states. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/boundary-control.md): When programmatically creating a Subject context using `SecurityManager.createSubject()` or `Subject.Builder` and executing operations that rely on the security context boundary. - [Cryptography](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/cryptography.md): When managing remember-me encryption keys and utilizing stream-based cipher operations. - [CSRF](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/csrf.md): Configuring authentication and web filter chains where state-changing actions such as user logout must be protected against Cross-Site Request Forgery. - [Deserialization](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/deserialization.md): When managing remembered user identity payloads via `AbstractRememberMeManager` in Apache Shiro to prevent deserialization vulnerabilities. - [Injection](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/injection.md): When configuring custom SQL queries for authentication, roles, or permissions in `JdbcRealm`. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/input-interpretation-safety.md): Parsing and interpreting untrusted format strings or class identifiers when obtaining dynamic `HashFormat` instances. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/secret-handling.md): Handling passwords, encryption keys, and system secrets during authentication token creation, hashing, LDAP configuration, or cipher key setup in Apache Shiro. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/security-control-integrity.md): When overriding default Shiro web filters, global configurations, or custom Spring bean definitions in a web application. - [Session Management](https://securitycards.rewarelabs.com/downloads/java/shiro/shiro-root-3-0-0/session-management.md): Configuring Apache Shiro session management and persistence mechanisms for production applications requiring durable sessions across application restarts and clustered deployments. ### Spring Framework v7.0.8 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/java/spring-framework/v7-0-8/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/access-control.md): Developing or configuring interceptors, CORS rules, and HTTP requests requiring role-based access control or tenant isolation in Spring MVC and WebFlux applications. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/api-contract-misuse.md): When validating target objects, invoking validators programmatically, or handling complex nested property paths using Spring validation utilities. - [Authentication](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/authentication.md): When supplying per-request dynamic credentials using UserCredentialsConnectionFactoryAdapter for JMS connections. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/boundary-control.md): Configuring test request builders, mock servlets, and request boundaries where URI paths, context paths, and servlet paths are processed to ensure path-based security controls evaluate correct URI seg… - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/configuration-source-integrity.md): When configuring application environment properties and essential settings during application startup. - [Deserialization](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/deserialization.md): When configuring HTTP message converters in Spring MVC to control allowed payload formats and prevent unintended deserialization. - [File Handling](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/file-handling.md): Handling user-supplied file paths and resolving them against a storage root directory. - [Injection](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/injection.md): Parsing and evaluating dynamic or user-influenced SpEL expressions. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/input-contract-definition.md): When developers need to enforce Jakarta Bean Validation rules, nested object checks, and container element constraints across services, domain objects, and message payloads. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/input-interpretation-safety.md): Parsing and validating untrusted URLs, request paths, or class names where alternate interpretations or parser differentials could bypass security checks. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/interface-protocol-hardening.md): Developing controllers, functional endpoints, or reactive server responses that serve sensitive data or require client-side security headers. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/network-boundary.md): Configuring dynamic HTTP redirects in Spring MVC applications where targets must be restricted to allowed internal domains. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/output-encoding.md): When constructing dynamic redirect URLs with RedirectView to prevent open redirect vulnerabilities and URL injection. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/resource-exhaustion.md): When bounding input parameters, data binders, database query collection parameters, and streaming decoders to prevent excessive memory or connection consumption. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/runtime-environment-hardening.md): Configuring application production runtime environments, logging levels, and debugging properties for Spring components. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/secret-handling.md): When logging diagnostic information, writing error messages, or handling database and messaging credentials in Spring applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/security-control-integrity.md): Configuring Spring WebMVC path matching configurations or implementing AOP security proxies. - [Session Management](https://securitycards.rewarelabs.com/downloads/java/spring-framework/v7-0-8/session-management.md): Developing and configuring session cookie resolvers, response cookies, or managing cookie security attributes in Spring Web applications. ## JavaScript Language catalog: https://securitycards.rewarelabs.com/llms/javascript.txt All JavaScript cards: https://securitycards.rewarelabs.com/downloads/javascript.md ### Axios v1.19.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/javascript/axios/v1-19-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/api-contract-misuse.md): Configuring Axios requests when custom response status validation or proper error throwing on 4xx or 5xx status codes is required. - [Authentication](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/authentication.md): When establishing and verifying user or service identity using HTTP Basic authentication, Bearer tokens, or custom headers in Axios requests. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/boundary-control.md): When appending shared sensitive payload fields or headers using request interceptors or `transformRequest` in Axios. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/configuration-source-integrity.md): Combining untrusted user inputs or external configurations into Axios request options, headers, authentication settings, or query parameters. - [CSRF](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/csrf.md): Making cross-origin requests using Axios where anti-CSRF token headers must be attached safely. - [Injection](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/injection.md): Setting custom request headers or handling dynamic inputs intended for HTTP headers. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/input-contract-definition.md): Making HTTP or HTTPS requests using Axios with untrusted dynamic endpoint URLs. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/input-driven-boundary-selection.md): Building request paths using dynamic user input combined with a `baseURL` in Axios. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/input-interpretation-safety.md): Parsing untrusted HTTP header directives and parameters where keys must be safely interpreted without allowing prototype pollution. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/interface-protocol-hardening.md): Making HTTPS requests in Node.js using Axios where custom TLS verification options or custom CA certificates are required. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/network-boundary.md): Configuring network proxy options and `NO_PROXY` bypass rules for Axios requests across corporate or restricted network boundaries. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/resource-exhaustion.md): Making HTTP requests or streaming large payloads to and from untrusted servers or endpoints where payload expansion or unconstrained data transfers can exhaust memory and network resources. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/runtime-environment-hardening.md): Configuring build environments, CI/CD pipelines, or package installations that process sensitive credentials and require minimized runtime attack surfaces. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/secret-handling.md): Configuring authentication headers, sensitive fields, and credentials for HTTP requests. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/security-control-integrity.md): Registering multiple request and response interceptors to apply security controls, authorization headers, or cryptographic signatures. - [Session Management](https://securitycards.rewarelabs.com/downloads/javascript/axios/v1-19-0/session-management.md): When making requests from a frontend application to a cross-origin API that relies on session cookies for authentication. ### Express v5.2.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/javascript/express/v5-2-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/access-control.md): Developing route handlers that require role checks, ownership verifications, or tenant constraints before executing business logic. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/api-contract-misuse.md): Implementing request handlers, middleware functions, and routing logic in Express 5 applications. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/boundary-control.md): When implementing authorization checks, security logging, or boundary access controls inside middleware or sub-applications mounted with prefix paths using `app.use()`. - [CSRF](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/csrf.md): Developing state-changing Express endpoints, such as `POST` routes or session termination handlers, that rely on session cookies or issue sensitive cookies. - [File Handling](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/file-handling.md): Handling file downloads via `res.sendFile()` or serving static assets using `express.static()` with user-influenced input. - [Injection](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/injection.md): Building database queries within Express handlers using user-supplied input. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/input-interpretation-safety.md): Extracting and utilizing untrusted path parameters or wildcards captured by `path-to-regexp` v8 in Express 5 handlers. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/interface-protocol-hardening.md): When configuring routing handlers and handling method dispatch in Express applications to prevent method confusion and protocol abuse. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/network-boundary.md): Handling HTTP redirect responses where target URLs are derived from request parameters or untrusted inputs. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/output-encoding.md): When serving JSON or JSONP responses that may be embedded directly within HTML documents or inline script blocks in Express. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/resource-exhaustion.md): Configuring request body parsing middleware such as `express.json()`, `express.urlencoded()`, `express.text()`, or `express.raw()` in an Express application. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/runtime-environment-hardening.md): When deploying the Express application to production and configuring runtime environment variables or error handling middleware to prevent stack trace and debugging information disclosure. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/secret-handling.md): Configuring session middleware or cookie-parser secrets for Express applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/security-control-integrity.md): Building and structuring the Express application middleware stack and defining error-handling routes. - [Session Management](https://securitycards.rewarelabs.com/downloads/javascript/express/v5-2-1/session-management.md): Handling user authentication and privilege elevation events in Express session middleware. ### Fastify v5.9.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/javascript/fastify/v5-9-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/access-control.md): Developing and organizing route handlers, plugins, and custom request lifecycle hooks. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/api-contract-misuse.md): When registering request-scoped properties or managing HTTP response lifecycles in Fastify applications. - [Authentication](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/authentication.md): When registering routes that require verification of identity credentials or tokens in Fastify applications. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/boundary-control.md): Structuring routes that require different security policies, such as authentication, within a Fastify application. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/configuration-source-integrity.md): When instantiating and configuring a Fastify application instance with security-sensitive properties. - [Cryptography](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/cryptography.md): Configuring inbound webhook endpoints and establishing secure HTTPS transport for server instances. - [CSRF](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/csrf.md): Protecting session-authenticated and state-changing application endpoints (POST, PUT, PATCH, DELETE) against unauthorized actions initiated from untrusted origins. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/dangerous-execution.md): When defining input validation and serialization schemas for Fastify routes, including querystrings, parameters, request bodies, and responses. - [Deserialization](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/deserialization.md): When parsing external JSON strings using `JSON.parse()` or similar methods before processing the resulting object. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/escape-hatch.md): Developing Fastify route handlers or custom plugins that require low-level control over network responses or connection lifecycles. - [File Handling](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/file-handling.md): When manually serving static files or assets, defining custom static routes, or bypassing the standard response lifecycle using hijack. - [Injection](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/injection.md): When executing database queries using database integration plugins, such as `@fastify/mysql` or `@fastify/postgres`, within Fastify route handlers. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/input-contract-definition.md): Configuring validation schemas for request bodies, headers, query parameters, or route parameters in Fastify routes. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/input-driven-boundary-selection.md): Implementing custom asynchronous route constraints to isolate tenant or resource boundaries based on incoming request headers. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/input-interpretation-safety.md): Configuring Fastify instances and processing early request payloads or parameter inputs. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/interface-protocol-hardening.md): Configuring Fastify routing, response trailers, and trusted proxy settings to prevent HTTP request smuggling and protocol spoofing. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/network-boundary.md): When deploying a Fastify application in containerized, serverless, or reverse-proxied network environments. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/output-encoding.md): When setting dynamic response headers or executing redirects with untrusted parameters. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/resource-exhaustion.md): When registering custom serializers, writing hooks, or implementing validation definitions. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/runtime-environment-hardening.md): When configuring the production deployment pipeline, container specifications, and package definitions for a Fastify application. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/secret-handling.md): When managing TLS key material, certificates, and runtime credentials in Fastify. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/security-control-integrity.md): When configuring and initializing validation, custom schema compilers, or routing rules during the server setup and bootstrap phases. - [Session Management](https://securitycards.rewarelabs.com/downloads/javascript/fastify/v5-9-0/session-management.md): When initializing a Fastify server that handles user sessions and requires stable infrastructure resource management. ### Koa v3.2.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/javascript/koa/v3-2-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/access-control.md): Enforcing access control, verifying user roles, and managing request-scoped permissions across Koa middleware and route handlers. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/api-contract-misuse.md): When throwing HTTP errors using `ctx.throw()` in Koa v3 to ensure proper argument types and signatures are supplied. - [Authentication](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/authentication.md): Implementing authentication middleware, protecting routes using context assertions, and issuing cryptographic session cookies. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/boundary-control.md): Configuring the Koa application instance to manage request-scoped data and error contexts safely across asynchronous execution boundaries. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/escape-hatch.md): When implementing custom low-level streaming or response handling by setting `ctx.respond = false` to bypass Koa's built-in response pipeline. - [File Handling](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/file-handling.md): Serving downloadable files and attachments to clients while preventing MIME-sniffing vulnerabilities. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/input-contract-definition.md): Validating incoming request content types against acceptable MIME types prior to parsing or processing payload data in Koa applications. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/input-driven-boundary-selection.md): Implementing hostname or subdomain-based request routing using `ctx.subdomains` or `ctx.hostname`. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/input-interpretation-safety.md): When updating query parameter handling and validation logic during migration to Koa v3.x where URLSearchParams replaces legacy querystring parsing. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/network-boundary.md): When deploying a Koa application behind a reverse proxy to manage network trust boundaries and inspect proxy headers safely. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/output-encoding.md): When rendering dynamic user input in Koa response bodies or redirect fallback messages to prevent HTML-context injection. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/runtime-environment-hardening.md): Instantiating the Koa application in a production deployment to prevent development mode behaviors. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/secret-handling.md): When configuring cookie signing keys and issuing signed cookies via `app.keys` in a Koa application. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/security-control-integrity.md): Developing or modifying Koa middleware functions that handle request routing, authorization, or context-population. - [Session Management](https://securitycards.rewarelabs.com/downloads/javascript/koa/v3-2-1/session-management.md): Configuring session identifiers, cookie attributes, and cryptographic keys using `ctx.cookies.set()` and `app.keys` in a Koa application. ### Multer v2.2.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/javascript/multer/v2-2-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/api-contract-misuse.md): When handling multipart file uploads in Express applications using Multer and implementing error-handling middleware or callback wrappers to capture size limits, filtering rejections, and parsing erro… - [Boundary Control](https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/boundary-control.md): Configuring file upload endpoints where multer is integrated into routing. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/escape-hatch.md): Handling file upload endpoints where incoming multipart form data field boundaries and file counts must be strictly controlled. - [File Handling](https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/file-handling.md): Configuring disk storage for file uploads in Multer to manage temporary files safely. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/input-contract-definition.md): When defining endpoints that handle multipart form submissions and file uploads to reject unexpected fields, excess files, and unauthorized file uploads. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/input-interpretation-safety.md): Handling multipart file upload requests containing non-ASCII filenames or parameters transmitted without RFC 5987 extended syntax. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/javascript/multer/v2-2-0/resource-exhaustion.md): Setting up Multer middleware to process multipart form data and file uploads in a Node.js application. ### Svelte Kit sveltejs.kit.2.70.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/javascript/svelte-kit/sveltejs-kit-2-70-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/access-control.md): Implementing server load functions, remote function handlers, or routes that handle sensitive user data and require access control verification. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/api-contract-misuse.md): Developing SvelteKit pages with links that navigate to routes containing load functions or GET endpoints with side-effects. - [Authentication](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/authentication.md): Verifying user authentication state and credentials inside server hooks before handling downstream request paths. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/configuration-source-integrity.md): When defining and validating environment variables at application build and startup time using `defineEnvVars`. - [Cryptography](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/cryptography.md): Generating secure tokens, identifiers, or random values in SvelteKit applications - [CSRF](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/csrf.md): Configuring deployment environment variables or reverse proxy headers for production builds to ensure SvelteKit correctly validates the origin of incoming state-changing requests. - [File Handling](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/file-handling.md): Developing HTML forms or remote functions that accept file uploads to ensure binary payloads are correctly transmitted and validated. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-contract-definition.md): Developing SvelteKit endpoints, remote functions, or dynamic routes that accept untrusted input parameters or request payloads. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-driven-boundary-selection.md): When performing client-side navigation using SvelteKit's `goto(...)` function to ensure external URLs are not passed into the internal routing utility. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/input-interpretation-safety.md): Processing captured route segment parameters in SvelteKit `load` functions or endpoint handlers - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/interface-protocol-hardening.md): Setting up HTTP security headers, response modifications, and CORS policies during server-side rendering, request handling, or API route definitions. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/network-boundary.md): Making server-side `fetch` requests inside load functions where automatic credential forwarding could leak authentication headers to external domains. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/resource-exhaustion.md): Configuring deployment adapters or building request handling hooks in SvelteKit to restrict incoming payload sizes. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/runtime-environment-hardening.md): Developing and building SvelteKit applications that contain development-only debug overlays or diagnostic UI components which must be completely removed from production client bundles. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/secret-handling.md): Developing server-side data loading, backend modules, form actions, or build configurations that manage sensitive tokens, API keys, and credentials in SvelteKit. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/security-control-integrity.md): Implementing custom error handling hooks in `src/hooks.server.js` to process server exceptions securely without leaking internal details. - [Session Management](https://securitycards.rewarelabs.com/downloads/javascript/svelte-kit/sveltejs-kit-2-70-1/session-management.md): Managing authenticated user sessions, setting session cookies, or handling user logout and revocation. ## PHP Language catalog: https://securitycards.rewarelabs.com/llms/php.txt All PHP cards: https://securitycards.rewarelabs.com/downloads/php.md ### Laravel v13.22.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/php/laravel/v13-22-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/access-control.md): Configuring cross-origin resource sharing headers, allowed methods, allowed origins, and middleware routing constraints in Laravel applications. - [Authentication](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/authentication.md): Configuring authentication guards, token storage, and multi-guard request routing. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/boundary-control.md): When registering a custom redirect handler using Authenticate::redirectUsing() to determine where unauthenticated users should be redirected. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/configuration-source-integrity.md): Configuring application environment paths and loading configuration files in Laravel. - [Cryptography](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/cryptography.md): Encrypting sensitive model attributes, session storage, environment configurations, and ensuring correct cipher and key length initialization. - [CSRF](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/csrf.md): When building state-changing HTML forms, routing endpoints, or configuring CSRF middleware and session cookie policies to prevent cross-site request forgery attacks. - [Deserialization](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/deserialization.md): When decrypting raw strings, cookies, or non-object values using `decrypt()` or `Encrypter` to prevent automatic PHP object instantiation. - [File Handling](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/file-handling.md): Configuring, storing, publishing, or serving static files and assets to ensure they remain protected against unauthorized disclosure, traversal, or modification. - [Injection](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/injection.md): When constructing database queries using user-controlled input in Laravel. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/input-contract-definition.md): Handling incoming HTTP requests and processing user input data against defined validation rules and contracts. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/input-interpretation-safety.md): When validating route parameters or path identifiers that undergo automatic URL decoding and require canonical interpretation. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/interface-protocol-hardening.md): Configuring Cross-Origin Resource Sharing in `config/cors.php` and ensuring the `HandleCors` middleware properly manages origin boundaries and HTTP response headers. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/network-boundary.md): Configuring upstream proxy trust boundaries and forwarded headers within the application middleware setup. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/output-encoding.md): Writing feature tests to verify that rendered response content is properly HTML-escaped by default in Laravel applications. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/resource-exhaustion.md): Use when configuring request rate limits or token repository throttles to defend application endpoints and authentication routes against burst traffic spikes, denial of service, and brute force attack… - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/runtime-environment-hardening.md): Configuring deployment environments and application bootstrapping settings to prevent the exposure of debug details, file paths, and stack traces. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/secret-handling.md): When implementing custom authentication guards, credential providers, password reset methods, or request wrappers that handle raw passwords, tokens, or encryption keys. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/security-control-integrity.md): Configuring HTTP middleware stack priorities and managing middleware exclusions in route groups or tests. - [Session Management](https://securitycards.rewarelabs.com/downloads/php/laravel/v13-22-0/session-management.md): Configuring session storage settings, security flags, and encryption parameters in production applications. ### Symfony v8.1.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/php/symfony/v8-1-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/access-control.md): When defining path rules, transport channels, HTTP methods, and access decision manager strategies in security configuration. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/api-contract-misuse.md): When retrieving attributes from security tokens or evaluating authentication attributes in background workers and non-interactive contexts. - [Authentication](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/authentication.md): Hardening authentication endpoints against brute-force attacks and account enumeration. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/boundary-control.md): Implementing HTTP kernel request event listeners, security filters, or failure handling middleware where untrusted inputs or sub-requests cross into trusted execution pipelines. - [Cryptography](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/cryptography.md): When hashing and verifying user credentials in Symfony applications to ensure proper cryptographic work factors and algorithms. - [CSRF](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/csrf.md): When configuring framework CSRF protection, form login authentication, or validating custom state-changing requests. - [File Handling](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/file-handling.md): Serving user-uploaded files and handling downloads via controller responses. - [Injection](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/injection.md): When configuring custom LDAP user search queries with `LdapBadge` in Symfony security components to prevent LDAP injection. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/input-interpretation-safety.md): Handling authentication credentials and CSRF tokens from incoming HTTP requests to prevent type confusion or parameter tampering bypasses. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/interface-protocol-hardening.md): Configuring request handling and HTTP method overriding mechanisms in Symfony applications. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/network-boundary.md): Configuring the Symfony framework when running applications behind reverse proxies or load balancers to secure network boundaries. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/output-encoding.md): Rendering the last authenticated username value derived from request or session input inside HTML templates to prevent Cross-Site Scripting. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/runtime-environment-hardening.md): Configuring Symfony application bundles and environment files for production deployment. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/secret-handling.md): When configuring application secrets, managing decryption keys, and handling credentials in Symfony applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/security-control-integrity.md): Developing or configuring authentication components and firewall managers where mandatory security badges and credential verification rules must be strictly enforced without bypass. - [Session Management](https://securitycards.rewarelabs.com/downloads/php/symfony/v8-1-1/session-management.md): When configuring application security firewalls and framework session settings for user authentication and cookie attributes. ## Python Language catalog: https://securitycards.rewarelabs.com/llms/python.txt All Python cards: https://securitycards.rewarelabs.com/downloads/python.md ### Aiohttp v3.14.3 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/aiohttp/v3-14-3/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/access-control.md): Implementing access control and header validation before accepting request bodies or acknowledging Expect: 100-continue requests in `aiohttp.web` applications. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/api-contract-misuse.md): Developing asynchronous network applications or web services using aiohttp Web-Sockets where multiple tasks might interact with a single WebSocket stream. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/boundary-control.md): When managing or filtering cookies within `aiohttp.ClientSession` or `CookieJar` to ensure boundary controls prevent cross-origin cookie leakage. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/configuration-source-integrity.md): Configuring aiohttp client sessions where environment variables and netrc files should not dictate proxy routing or authentication credentials. - [Deserialization](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/deserialization.md): When loading cookie files into `aiohttp.CookieJar` where untrusted data could lead to arbitrary object construction via insecure pickling. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/file-handling.md): Handling file uploads from multipart requests and configuring static file routes in aiohttp web applications. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/input-driven-boundary-selection.md): Making asynchronous requests to target URLs provided by untrusted users using `session.get()`. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/input-interpretation-safety.md): Processing incoming request paths, IP addresses, cookie parameters, and query strings where alternate, non-canonical, or encoded representations could bypass authorization or filtering checks. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/interface-protocol-hardening.md): Developing aiohttp web handlers that return `401 Unauthorized` responses and need to enforce protocol security policies. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/network-boundary.md): Configuring request proxy settings, parsing proxy headers behind a reverse proxy, or managing cookie security origins in aiohttp. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/output-encoding.md): Rendering dynamic user input or serving static files in `aiohttp` web applications to prevent browser-based script execution. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/resource-exhaustion.md): Developing asynchronous HTTP clients with `aiohttp` to ensure remote endpoints and excessive inputs do not consume unbounded local resources. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/runtime-environment-hardening.md): Configuring aiohttp client sessions, event loops, and web servers for production deployment. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/secret-handling.md): Configuring client sessions, middleware, or requests requiring authentication credentials in `aiohttp` applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/security-control-integrity.md): When configuring and executing client requests with `aiohttp.ClientSession` where session-level middlewares handle critical security controls. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/aiohttp/v3-14-3/session-management.md): Handling user logout or revoking an active user session in an aiohttp server application. ### Cryptography 49.0.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/cryptography/49-0-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/api-contract-misuse.md): When calling cryptographic primitives, encryption/decryption methods, key serialization, or integer-to-bytes conversions that require exact parameter types, correct argument counts, matching buffer si… - [Authentication](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/authentication.md): Verifying user passwords or credentials using password hashing and verification verifiers. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/cryptography.md): Generating secure cryptographic keys, salts, and nonces for encryption, MACs, or key derivation. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/escape-hatch.md): Deserializing RSA private keys from user-supplied or untrusted input sources using serialization functions. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/input-contract-definition.md): When constructing cryptographic primitives, key derivation functions, certificates, and tokens that require strict input validation, parameter bounds checking, type validation, and allowed value const… - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/input-interpretation-safety.md): When loading untrusted asymmetric keys, signatures, certificates, CRLs, OCSP requests, or encoded points from external sources. - [Memory Safety](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/memory-safety.md): Passing data buffers to `cryptography` methods where memory safety and data integrity must be maintained against concurrent modifications. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/resource-exhaustion.md): Encrypting or decrypting large data streams, files, or buffers using AEAD or Fernet primitives. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/secret-handling.md): Serializing private keys, certificates, or handling sensitive secrets in storage or configuration. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/security-control-integrity.md): Implementing error handling for cryptographic verification functions such as token verification or AEAD decryption where failures must fail closed. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/cryptography/49-0-0/session-management.md): When validating time-sensitive session state or transient session tokens using Fernet symmetric encryption. ### Django 6.1rc1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/django/6-1rc1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/access-control.md): Protecting function-based views or class-based views to ensure only authenticated and authorized users can access specific functionality or resources. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/api-contract-misuse.md): When configuring email messages with blind carbon copy recipients using `EmailMessage`. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/authentication.md): When handling account recovery tokens, session authentication logins, and user verification workflows. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/boundary-control.md): Deploying Django behind a reverse proxy to handle secure connection transitions at the server boundary. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/cryptography.md): Configuring password storage and handling user credentials securely in Django applications. - [CSRF](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/csrf.md): Developing Django web applications that process state-changing requests and require cross-origin or standard form submission protection against cross-site request forgery. - [Deserialization](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/deserialization.md): When configuring session serialization or handling signed objects and payloads to prevent unsafe arbitrary object construction and remote code execution. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/file-handling.md): When configuring file storage options to prevent user-controlled or colliding filenames from overwriting existing assets or data files. - [Injection](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/injection.md): Building database queries with Django QuerySets, raw SQL strings, or expression functions where untrusted user input is involved. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/input-contract-definition.md): When defining URL patterns, configuring path converters, implementing custom converters, or handling request host verification. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/input-interpretation-safety.md): Handling user-provided strings, handles, or registration data that require canonical representation and unambiguous interpretation. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/interface-protocol-hardening.md): Configuring transport security, MIME-sniffing protection, referrer policies, and cross-origin isolation headers for web applications. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/network-boundary.md): Configuring Django's email backend to send messages securely over SMTP. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/output-encoding.md): When rendering dynamic user input, constructing custom template tags or filters, or embedding data into HTML templates and attributes. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/resource-exhaustion.md): When building forms, formsets, or handling request payloads that process untrusted user input. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/runtime-environment-hardening.md): Preparing Django applications for production deployment and configuring runtime settings. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/secret-handling.md): Configuring Django settings and application credentials in production or deployment environments. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/security-control-integrity.md): Configuring the `MIDDLEWARE` setting in Django applications where security controls depend on state established by upstream middleware. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/django/6-1rc1/session-management.md): Configuring session cookies and production settings to ensure cookies are transmitted securely and protected against interception or client-side extraction. ### Fastapi 0.139.2 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/fastapi/0-139-2/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/access-control.md): Use when adding `CORSMiddleware` to a FastAPI application to govern cross-origin browser requests and safely expose custom headers. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/api-contract-misuse.md): Defining route handlers and specifying response serialization models for API endpoints. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/authentication.md): Verifying user credentials, password hashes, or token signatures during authentication workflows. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/cryptography.md): Implementing user registration and credential verification workflows in FastAPI applications requiring secure password hashing. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/file-handling.md): You are mounting static directories or asset files in a FastAPI application. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/input-contract-definition.md): Building FastAPI endpoints and validating incoming request parameters, query strings, headers, cookies, and form bodies. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/input-interpretation-safety.md): Developing route handlers and request parsing where input content types and payload formats must be strictly validated. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/interface-protocol-hardening.md): Handling authentication failures in FastAPI application dependencies returning HTTP 401 Unauthorized responses. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/output-encoding.md): Customizing interactive API documentation pages that render configuration dictionaries or parameters inside HTML script tags. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/resource-exhaustion.md): Building FastAPI endpoints that accept request payloads and data bodies which might be leveraged by adversaries for denial of service via unbounded memory consumption. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/runtime-environment-hardening.md): Configuring the production runtime environment for deployment to disable verbose error exposure and development-specific server settings. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/secret-handling.md): Configuring secret keys, API tokens, or cryptographic signing material for FastAPI applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/security-control-integrity.md): Configuring security, logging, or rate-limiting middleware in a FastAPI application using `app.add_middleware()` or `@app.middleware()`. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/fastapi/0-139-2/session-management.md): Building stateless or stateful session authentication in FastAPI where session identifiers or tokens must be validated for expiration and lifetime constraints. ### Flask 3.1.3 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/flask/3-1-3/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/access-control.md): When building state-changing operations or resource modification routes in Flask where authenticated users perform updates or deletions on records. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/api-contract-misuse.md): Configuring application error handling, setting production flags, and registering custom error handlers or teardown hooks. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/authentication.md): Handling user registration and login requests to verify presented identity credentials before creating session variables or querying the database. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/boundary-control.md): Developing or configuring custom WSGI middleware, reverse proxy integrations, and application context routing boundaries in Flask applications. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/configuration-source-integrity.md): When loading configuration and environment variables via `load_dotenv()` in Flask applications. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/cryptography.md): When registering new users or validating user login credentials in a web application. - [CSRF](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/csrf.md): Developing state-changing routes and configuring session cookie policies in Flask applications to prevent cross-site request forgery. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/dangerous-execution.md): Configuring deployment settings and launching the application in a production environment. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/escape-hatch.md): Rendering trusted field widget calls within template macros where HTML structure must be preserved. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/file-handling.md): Handling file uploads from users or serving requested files from the filesystem. - [Injection](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/injection.md): Writing database queries with dynamic user input in Flask applications. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/input-contract-definition.md): Handling incoming HTTP request form data or query parameters that require structural and type validation before executing business logic. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/interface-protocol-hardening.md): Developing response processors, custom session interfaces, or after-request hooks in Flask to harden network protocol semantics and enforce browser security controls. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/network-boundary.md): Configuring network trust boundaries and verifying remote IP addresses or proxy configurations in Flask applications. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/output-encoding.md): Rendering manual HTML strings or dynamic user-controlled data within HTML templates and attributes. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/resource-exhaustion.md): Configuring Flask application settings to restrict incoming payload sizes and multipart form parsing consumption. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/runtime-environment-hardening.md): Deploying the Flask application to a live production environment rather than running it locally for development. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/secret-handling.md): Configuring Flask application secrets and setting up secure credential management for session signing. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/security-control-integrity.md): Testing request-dependent code using `app.test_request_context()` where tests depend on security controls or identity population configured inside `before_request` hooks. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/flask/3-1-3/session-management.md): Configuring session cookie security attributes, managing session lifetimes, and clearing or updating session data during user login, logout, and state modifications. ### Httpx 0.28.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/httpx/0-28-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/api-contract-misuse.md): Developing custom authentication flows by subclassing `httpx.Auth` that inspect request or response content. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/authentication.md): When establishing client authentication, passing credentials, or implementing custom authentication handlers in HTTPX. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/configuration-source-integrity.md): Instantiating an `httpx.Client` or `httpx.AsyncClient` in multi-tenant or untrusted environments where ambient environment variables may be manipulated by external actors. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/cryptography.md): Configuring client certificate validation, custom CA bundles, or connecting over HTTPS using HTTPX. - [Injection](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/injection.md): Constructing HTTP requests from untrusted user input that may contain control characters or malformed syntax. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/input-interpretation-safety.md): When processing external or untrusted URL strings to prevent parser differentials and invalid input interpretations before executing HTTP requests. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/interface-protocol-hardening.md): Configuring HTTPX clients to handle connection failures and transient network timeouts safely using transport-level retries. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/network-boundary.md): Making HTTP requests where automatic redirects might cross network boundaries or expose sensitive credentials to untrusted origins. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/resource-exhaustion.md): When building HTTP client requests and managing connection transports to prevent thread starvation and resource exhaustion. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/secret-handling.md): When developers configure client instances with default headers or custom authentication properties, or manage redirection behaviors. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/security-control-integrity.md): When registering response event hooks on an HTTPX client to consistently enforce status code checking across all operations. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/httpx/0-28-1/session-management.md): Managing session state and cookie persistence across requests when using `httpx.Client`. ### Jinja 3.1.6 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/jinja/3-1-6/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/access-control.md): When rendering untrusted user-supplied templates or exposing Python objects and functions to templates where unauthorized actions, side effects, or cross-boundary data access must be prevented. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/api-contract-misuse.md): When creating custom Jinja extensions that need to manage state or configuration across templates. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/boundary-control.md): Rendering untrusted templates where data structures and application state must be protected against modification during execution. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/dangerous-execution.md): Configuring Jinja environment extensions or resolving dynamic helper strings that use `import_string` or extension loading mechanisms. - [Deserialization](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/deserialization.md): Configuring Jinja bytecode caches or handling serialized Environment instances where untrusted data or insecure deserialization could lead to arbitrary code execution. - [Injection](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/injection.md): Rendering dynamic HTML or XML attributes using the `xmlattr` filter in templates to prevent attribute injection. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/input-interpretation-safety.md): When templates contain literal Jinja delimiters or front-end framework placeholders that should be interpreted strictly as literal text rather than being parsed and executed. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/output-encoding.md): When rendering dynamic templates or handling untrusted user input within HTML and internationalization contexts to prevent cross-site scripting. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/resource-exhaustion.md): Rendering untrusted templates where attackers might trigger excessive CPU or memory consumption using large ranges or expensive operators. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/runtime-environment-hardening.md): Configuring Jinja environments in production to restrict runtime behavior and disable unsafe debugging output. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/secret-handling.md): Configuring Jinja environments in Python applications where sensitive variables or environment settings might be inadvertently exposed in production. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/jinja/3-1-6/security-control-integrity.md): When rendering templates that process untrusted input or use string formatting expressions that could potentially traverse object graphs and bypass standard security checks. ### Langchain langchain.1.3.14 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/langchain/langchain-1-3-14/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/access-control.md): Configuring human-in-the-loop validation or access control boundaries for agent tool executions. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/api-contract-misuse.md): When initializing or configuring LangChain models, text splitters, tool bindings, and middleware components that enforce strict argument types, value ranges, and compatibility requirements. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/authentication.md): Configuring chat models and authentication providers that require dynamic tokens instead of static API keys or unverified claims. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/boundary-control.md): When configuring Anthropic agent tool middleware such as state-based file or memory tool operations where untrusted model input dictates paths that cross application boundaries. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/dangerous-execution.md): Configuring execution environments for shell tool middleware and parsing prompt templates with string formatters or dynamic environments. - [Deserialization](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/deserialization.md): Deserializing untrusted payloads or manifests in LangChain workflows where arbitrary object instantiation must be prevented. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/file-handling.md): Configuring file search middleware or processing file patch tool operations in agentic workflows. - [Injection](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/injection.md): Formatting sequences of messages that include untrusted user input into conversation strings for model prompts. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/input-contract-definition.md): Building tools and Runnable chains that process external user inputs or dynamic model calls in LangChain - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/input-driven-boundary-selection.md): When configuring fallback models or routing specifications that instantiate models dynamically from string identifiers. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/input-interpretation-safety.md): When processing tool call arguments and structured model outputs returned by chat models to prevent malformed or unvalidated payloads from reaching downstream tools. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/interface-protocol-hardening.md): Configuring service endpoints and base URLs for client connections to prevent protocol smuggling or unsupported protocol handlers. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/network-boundary.md): Making outbound HTTP requests, processing dynamic or user-provided URLs in agent tools, or configuring chat model connections in LangChain. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/resource-exhaustion.md): When building agents and LLM-powered applications using LangChain where operations, model calls, tools, or shell commands could consume unbounded system resources, memory, or time. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/runtime-environment-hardening.md): Configuring container execution policies and runtime privileges when running shell tools. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/secret-handling.md): When instantiating model wrappers, clients, and providers in LangChain, or loading secrets from configuration sources. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/langchain/langchain-1-3-14/security-control-integrity.md): When trimming chat history sequences or managing context windows in language model interactions where security instructions or guardrails must not be dropped. ### Llama Index v0.14.23 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/llama-index/v0-14-23/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/access-control.md): When building retrieval-augmented generation apps or chat storage workflows that load indexes, vectors, or chat histories based on user-supplied parameters. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/authentication.md): Integrating LlamaIndex with cloud services, vector stores, and readers where identity and credentials must be established via tokens, service accounts, or managed identities. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/boundary-control.md): Integrating guardrails, scanners, or server-side safety filters to validate user prompts and inspect LLM outputs when processing queries in multimodal RAG applications. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/dangerous-execution.md): Configuring model loaders and initializers where custom scripts or remote execution mechanisms might be enabled. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/file-handling.md): When accepting local file paths or destination paths from user input or remote tools that interact with the local filesystem, code interpreter downloads, or document parsing blocks. - [Injection](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/injection.md): Building database readers, executing queries, or configuring chat stores with dynamic database parameters. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/input-interpretation-safety.md): Passing prompt templates or completion strings containing literal curly braces or untrusted user input to LLM completion methods. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/network-boundary.md): Configuring LLMs, vector stores, and external data connectors that establish outbound network connections over HTTPS or TLS. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/resource-exhaustion.md): Handling raw user-supplied strings or inputs before submitting them to ingestion pipelines or query components. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/runtime-environment-hardening.md): Configuring Elasticsearch vector store backends in production environments for LlamaIndex applications. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/secret-handling.md): Instantiating cloud tools and readers that acquire and store OAuth access and refresh tokens. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/llama-index/v0-14-23/session-management.md): Developing multi-tenant applications using LlamaIndex chat memory or tool specifications where distinct user sessions must be isolated. ### Pydantic v2.13.4 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/pydantic/v2-13-4/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/api-contract-misuse.md): When defining Pydantic models for external APIs and handling field aliases or serialization formats to prevent API contract violations. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/boundary-control.md): Parsing untrusted external input payloads or configuration data at application boundaries. - [Deserialization](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/deserialization.md): When validating YAML data files with Pydantic models to prevent arbitrary object instantiation and code execution before schema validation. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/escape-hatch.md): Processing untrusted input data or working with low-level Pydantic methods that bypass normal runtime schema validation, type checking, and field constraints. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/input-contract-definition.md): Use when designing and validating incoming API requests, external file payloads, or untrusted data models to ensure inputs adhere strictly to defined types, ranges, lengths, and extra field restrictio… - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/input-interpretation-safety.md): When validating external or untrusted input payloads where automatic type coercion could alter expected data structures or bypass input verification. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/resource-exhaustion.md): When defining Pydantic models or `pydantic_core` schemas for collections, strings, bytes, and URLs supplied by external or untrusted users. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/secret-handling.md): Defining Pydantic models that process or store sensitive data like API keys, passwords, tokens, or personal information. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/pydantic/v2-13-4/security-control-integrity.md): Defining Pydantic dataclasses or utilizing internal dataclass construction where attribute mutation or validation suppression could bypass security invariants. ### Pyjwt 2.13.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/pyjwt/2-13-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/api-contract-misuse.md): Calling `jwt.get_unverified_header()` or `PyJWKClient.get_signing_key_from_jwt()` to inspect header metadata or retrieve a signing key before processing a JSON Web Token. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/cryptography.md): Verifying cryptographic signatures and handling key parameters during token processing - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/input-contract-definition.md): When validating incoming JSON Web Tokens using jwt.decode to ensure essential payload claims are present. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/input-interpretation-safety.md): Parsing or configuring cryptographic keys from external JSON representations during token verification. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/network-boundary.md): Instantiating `PyJWKClient` to fetch remote JSON Web Key Sets for token verification. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/runtime-environment-hardening.md): Configuring the production runtime and deployment environment to support asymmetric token verification via `PyJWK` or `PyJWKSet`. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/secret-handling.md): When loading secret keys and configuring authentication parameters prior to token signing or verification. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/pyjwt/2-13-0/security-control-integrity.md): Decoding and verifying JSON Web Tokens where validation errors must result in explicit authentication rejections rather than unhandled exceptions or bypassed controls. ### Pyyaml 6.0.3 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/pyyaml/6-0-3/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/api-contract-misuse.md): When managing direct serializer lifecycles to emit YAML events from AST nodes. - [Deserialization](https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/deserialization.md): Parsing untrusted YAML configuration files or defining custom loader classes and path resolvers. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/input-contract-definition.md): When parsing untrusted YAML input streams that are expected to contain exactly one document structure. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/input-interpretation-safety.md): When parsing untrusted YAML data streams, byte sequences, or configuration files in Python applications using PyYAML. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/resource-exhaustion.md): Parsing untrusted YAML documents using PyYAML to prevent resource exhaustion from deeply nested structures. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/secret-handling.md): Catching parsing errors when processing YAML documents containing secrets, credentials, or sensitive path names. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/pyyaml/6-0-3/security-control-integrity.md): Registering custom tag constructors for YAML parsing where security controls like `yaml.safe_load` must remain consistently applied and enabled across execution paths. ### Requests v2.34.2 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/requests/v2-34-2/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/api-contract-misuse.md): Processing response data or parsing payloads returned from HTTP requests. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/authentication.md): Establishing and verifying identity using credentials, tokens, or digest authentication when sending HTTP requests. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/boundary-control.md): When accepting dynamic or user-supplied target URL strings before passing them to requests functions. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/configuration-source-integrity.md): Configuring HTTP sessions in multi-tenant, serverless, or untrusted environments where local environment variables or .netrc files could be manipulated by external actors. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/file-handling.md): Writing or updating files on disk to prevent race conditions or partially written data exposure. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/input-interpretation-safety.md): Serializing data structures to JSON payloads via the `json` parameter in requests. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/interface-protocol-hardening.md): When handling HTTP responses from external servers and parsing message framing and headers. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/network-boundary.md): Configuring trusted proxy environments and destination bypass rules for outbound requests. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/resource-exhaustion.md): Making HTTP requests using the requests library where unmanaged streams or missing timeouts can lead to connection exhaustion and thread blocking. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/secret-handling.md): Configuring requests with client certificates, basic authentication, netrc files, or handling ephemeral tokens. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/security-control-integrity.md): Building requests manually using `PreparedRequest` and sending them with `Session.send()` where system trust stores and environment configurations must be applied. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/requests/v2-34-2/session-management.md): Creating custom cookies programmatically or adding them to a RequestsCookieJar for session management. ### Sqlalchemy rel.2.0.51 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/sqlalchemy/rel-2-0-51/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/access-control.md): Enforcing tenant isolation or row-level access control on database queries using SQLAlchemy ORM relationship loader options. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/api-contract-misuse.md): When executing queries with joined collection relationships or server-side cursors where specific result processing methods and execution options are mandated by the API contract. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/authentication.md): Connecting to Microsoft SQL Server or Azure SQL Database using dynamic Azure Active Directory access tokens via SQLAlchemy event listeners. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/boundary-control.md): Reflecting database metadata or defining table schemas against PostgreSQL databases where search_path configurations or schema names may lead to schema shadowing and unintended data access boundaries. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/configuration-source-integrity.md): Configuring database engines with database-specific dialects like Oracle where dynamic introspection can alter critical configuration behavior. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/cryptography.md): Configuring database connection URLs with extensions like SQLCipher where encryption settings and key derivation iteration counts must be explicitly specified. - [Deserialization](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/deserialization.md): Deserializing data streams, query states, ORM objects, or result rows from untrusted sources or network endpoints where arbitrary code execution must be prevented. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/escape-hatch.md): Rendering raw SQL fragments using low-level escape hatch mechanisms like text() or literal_column() within SQLAlchemy Core or ORM queries. - [Injection](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/injection.md): When executing queries, building DML statements, or filtering database entities using SQLAlchemy Core, ORM, or textual SQL. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/input-contract-definition.md): Implementing custom mutable scalar or composite types with `Mutable` or `MutableComposite` in SQLAlchemy ORM models where incoming assignments require structural type validation and rejection of unexp… - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/input-driven-boundary-selection.md): When using `ShardedSession` to execute persistence and query operations across multiple database instances. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/input-interpretation-safety.md): When constructing database connection URLs dynamically using credentials or components containing special characters to prevent parsing and component boundary misinterpretation. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/network-boundary.md): Constructing SQLAlchemy database connection URLs when database endpoints must remain within fixed network boundaries. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/resource-exhaustion.md): Streaming or querying large datasets in SQLAlchemy to prevent memory exhaustion and database connection degradation. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/secret-handling.md): Configuring database connection strings, engine URLs, and cryptographic parameters requiring sensitive credentials or passphrases. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/security-control-integrity.md): When building cached SQL statements using `lambda_stmt` or adding criteria that involve conditional branching or tenant isolation filters. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/sqlalchemy/rel-2-0-51/session-management.md): When managing database sessions and connection scopes across multi-threaded or asynchronous application requests and task handlers. ### Starlette 1.3.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/starlette/1-3-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/access-control.md): When building HTTP endpoints or WebSocket handlers in Starlette that require permission checks, role checks, or authentication state enforcement. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/api-contract-misuse.md): When handling HTTP requests in Starlette and needing to read the request data as both a stream and a full body. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/authentication.md): When building custom authentication backends in Starlette to establish and verify user identity from request headers or credentials. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/configuration-source-integrity.md): Accessing and managing environment variables programmatically during application setup or initialization to prevent runtime mutation and configuration inconsistency. - [CSRF](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/csrf.md): Configuring session handling in Starlette applications to protect state-changing requests from cross-site request forgery. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/file-handling.md): Handling user-influenced file paths when serving files via `FileResponse`. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/input-contract-definition.md): Defining URL route patterns and path parameters in Starlette to ensure malformed inputs are rejected before reaching endpoint handlers. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/interface-protocol-hardening.md): Configuring Starlette CORSMiddleware security headers to restrict cross-origin access, handle credentials securely, and control private network access. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/network-boundary.md): Configuring access controls, rate limits, or security middleware that depend on client IP addresses and network trust boundaries behind reverse proxies. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/output-encoding.md): Rendering dynamic user input into HTML templates using Starlette templates and a custom `jinja2.Environment`. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/resource-exhaustion.md): Handling incoming HTTP requests, JSON payloads, or multipart/form-data uploads in Starlette endpoints. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/runtime-environment-hardening.md): Configuring production environments when instantiating `ServerErrorMiddleware` or configuring Starlette applications. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/secret-handling.md): When loading session keys, application secrets, or sensitive configuration values into Starlette middleware or components. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/security-control-integrity.md): When managing authentication states, audit metadata, or security context across middleware boundaries and endpoint handlers in Starlette. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/starlette/1-3-1/session-management.md): Configuring session state handling and cookie attributes for Starlette applications. ### Urllib3 2.7.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/urllib3/2-7-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/api-contract-misuse.md): Handling connection errors and exception attributes when interacting with remote services using urllib3. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/authentication.md): Establishing mutual TLS client identity verification using client certificates, private keys, and certificate authorities. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/boundary-control.md): Validating untrusted URLs or enforcing host allowlists at a system boundary before passing state to trusted logic or network clients. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/cryptography.md): When pinning server certificates to validate peer identity and prevent timing side-channel attacks. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/input-contract-definition.md): When validating untrusted input string URLs and enforcing strict port boundaries before passing them to networking components. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/input-interpretation-safety.md): Constructing URLs with user-supplied components or parsing hostnames and parameters in urllib3 - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/interface-protocol-hardening.md): Making HTTP requests and defining custom method names using urllib3 - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/network-boundary.md): Configuring outbound connections through proxy managers or SOCKS proxies where transport security and endpoint reachability must be protected across network boundaries. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/resource-exhaustion.md): Making HTTP requests when you need to prevent threads or processes from hanging indefinitely due to slow or unresponsive servers. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/runtime-environment-hardening.md): Configuring the production runtime environment and container base images for deploying applications using urllib3. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/secret-handling.md): Configuring connection retry behaviors and making HTTP requests where custom API keys or authentication tokens may be exposed during cross-host redirects. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/security-control-integrity.md): Configuring warning management and logging for HTTP request execution where security controls and transport alerts must remain active. - [Session Management](https://securitycards.rewarelabs.com/downloads/python/urllib3/2-7-0/session-management.md): Handling session cookies returned in urllib3 HTTP responses to ensure security attributes like HttpOnly and path restrictions are properly interpreted. ### Vllm v0.26.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/python/vllm/v0-26-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/access-control.md): Configuring file access and cross-origin resource sharing for model inputs and server endpoints. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/api-contract-misuse.md): Applying chat templates and configuring tokenization or request parameters for language model inference. - [Authentication](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/authentication.md): Deploying and starting the vLLM OpenAI API server to ensure incoming requests are authenticated. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/boundary-control.md): Serving chat models and configuring request parameters to prevent unauthorized tool execution when tool use is explicitly disabled. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/configuration-source-integrity.md): Setting up server configurations, YAML files, environment variables, and deployment scripts for vLLM services. - [Cryptography](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/cryptography.md): When serializing or deserializing vLLM models and LoRA adapters using Tensorizer and `TensorizerConfig` to prevent unauthorized inspection or theft. - [Deserialization](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/deserialization.md): Configuring deployment environments and environment variables for vLLM to handle untrusted requests safely. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/escape-hatch.md): Configuring the `LLM` engine and managing multimodal inputs where raw pre-computed embedding inputs could bypass media pre-processing validation. - [File Handling](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/file-handling.md): Handling user-supplied file paths, multimodal media inputs, datasets, or template configurations in vLLM. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/input-contract-definition.md): When handling incoming chat completion, tokenization, generation, and batch requests to ensure parameters conform to required types, ranges, lengths, and logical constraints. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/input-driven-boundary-selection.md): Handling chat completion requests in a multi-tenant environment or shared vLLM instance where prompt prefix caches must be strictly partitioned. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/input-interpretation-safety.md): When validating, sanitizing, or parsing untrusted user chat messages, prompt strings, tool call arguments, or reasoning effort parameters to ensure unambiguous interpretation and prevent parser tamper… - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/interface-protocol-hardening.md): Configuring cross-origin resource sharing policies for the vLLM API server to prevent cross-site request abuse. - [Memory Safety](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/memory-safety.md): Processing user-supplied sparse COO tensors or prompt embeddings to prevent out-of-bounds memory writes. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/network-boundary.md): Configuring network connections, multi-port external load balancing, or benchmark HTTP clients communicating with remote or public endpoints. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/resource-exhaustion.md): When configuring vLLM inference servers and processing media files, requests, or structured inputs that could cause resource exhaustion or out-of-memory errors. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/runtime-environment-hardening.md): Deploying vLLM serving instances to production environments where unprivileged access and reduced attack surface are required. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/secret-handling.md): Setting up Hugging Face tokens, OpenAI API keys, and server authorization credentials for benchmark runners and API servers. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/python/vllm/v0-26-0/security-control-integrity.md): Developing or extending control message handlers for P2P offloading in vLLM to ensure protocol violations trigger immediate connection termination. ## Ruby Language catalog: https://securitycards.rewarelabs.com/llms/ruby.txt All Ruby cards: https://securitycards.rewarelabs.com/downloads/ruby.md ### Rails v8.1.3 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/ruby/rails/v8-1-3/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/access-control.md): When updating, editing, or deleting user-owned resources in controller actions to enforce ownership checks and prevent IDOR vulnerabilities. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/api-contract-misuse.md): Querying database models that utilize composite primary keys using Active Record finder methods. - [Authentication](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/authentication.md): Implementing controller authentication callbacks or handling HTTP token and basic authentication headers. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/boundary-control.md): When handling cryptographically signed or encrypted tokens, messages, or session states across trust boundaries where payloads might be replayed or abused in unauthorized contexts. - [Cryptography](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/cryptography.md): When configuring ActiveRecord Encryption ciphers, key derivation parameters, and handling migration or decryption error workflows. - [CSRF](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/csrf.md): Building web applications, processing form submissions, and configuring state-changing endpoints in Rails controllers or views. - [Deserialization](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/deserialization.md): When configuring session cookies, message encryptors, message verifiers, or cryptographic serializers to handle untrusted data and prevent arbitrary object instantiation or execution. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/escape-hatch.md): When constructing database queries using raw SQL fragments or low-level ordering and clause methods in ActiveRecord. - [File Handling](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/file-handling.md): Configuring asset delivery, middleware stacks, and reverse proxy offloading for public static files. - [Injection](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/injection.md): Building database queries, Common Table Expressions, or condition strings using Active Record methods with user-supplied input. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/input-contract-definition.md): When processing incoming HTTP request parameters, API payloads, or locale selections before passing them into model mass-assignment methods or application logic. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/input-interpretation-safety.md): You are writing queries with raw SQL fragments or parsing input parameters where values must be canonicalized or normalized to ensure unambiguous interpretation. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/interface-protocol-hardening.md): Configuring global application security headers, transport security, content security policies, and permissions policies in Rails production or development environments. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/network-boundary.md): When operating the Rails application behind an upstream proxy, load balancer, or reverse proxy handling SSL termination and network routing boundaries. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/output-encoding.md): Rendering dynamic text, attributes, or user-supplied content within Action View ERB templates. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/resource-exhaustion.md): When setting up cloud storage configurations, database connection pools, or query caches in Rails applications to prevent thread and resource exhaustion. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/runtime-environment-hardening.md): Configuring application environments for production deployment to prevent information disclosure. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/secret-handling.md): Configuring request parameter logging and handling event notification payloads. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/security-control-integrity.md): Developing database migrations and defining ActiveRecord associations where model-level validations are insufficient to prevent race conditions and bypasses. - [Session Management](https://securitycards.rewarelabs.com/downloads/ruby/rails/v8-1-3/session-management.md): When managing session cookies, enforcing expiration limits, and handling user authentication state transitions in Rails. ## Rust Language catalog: https://securitycards.rewarelabs.com/llms/rust.txt All Rust cards: https://securitycards.rewarelabs.com/downloads/rust.md ### Actix Web web.v4.14.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/rust/actix-web/web-v4-14-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/access-control.md): Enforcing access control, permissions, and request filtering across routes, resources, scopes, and middleware handlers in Actix Web. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/api-contract-misuse.md): Extracting URL query parameters into strongly typed structures within Actix Web request handlers. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/boundary-control.md): When registering routes, scopes, and dynamic path segments in Actix-web applications to ensure requests are routed through proper security boundaries. - [Cryptography](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/cryptography.md): When performing RFC 6455 WebSocket handshake challenge-response generation using `hash_key`. - [Deserialization](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/deserialization.md): Deserializing structured response data from remote endpoints via `ClientResponse::json()` where content-type checks and payload limits prevent memory exhaustion or unexpected parsing. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/escape-hatch.md): Configuring network client transport capabilities and dependencies where transport-layer security features must be enforced instead of unencrypted bypasses. - [File Handling](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/file-handling.md): Configuring static file serving or processing user-influenced file paths and uploads to prevent unauthorized file access, path traversal, and dotfile disclosure. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/input-contract-definition.md): Handling structured form and multipart file uploads where unexpected fields or duplicate parameters must be rejected to prevent parameter pollution. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/input-interpretation-safety.md): Retrieving and validating request cookies or path match information where percent-decoding behavior affects security decisions and cryptographic checks. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/interface-protocol-hardening.md): Developing Actix Web applications and defining middleware, error handlers, or routes that require security headers like Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, or Content-S… - [Network Boundary](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/network-boundary.md): When configuring IP-based access controls, rate limiting, or network logging in Actix Web services deployed behind reverse proxies or handling direct client connections. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/output-encoding.md): Building HTTP responses, serving files, or returning string responders that include dynamic user data in Actix Web applications. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/resource-exhaustion.md): Configuring transport protocols, server instances, client connections, and request timeouts to protect against slowloris and resource exhaustion attacks. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/runtime-environment-hardening.md): Configuring crate dependencies and feature flags for production deployment - [Secret Handling](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/secret-handling.md): When logging HTTP requests, client requests, or WebSocket connections containing sensitive credentials, bearer tokens, cookies, or authorization headers in Actix-web and `awc` applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/security-control-integrity.md): When registering security middleware, conditional wrappers, or route handlers in Actix Web applications to ensure security controls execute properly and do not fail open. - [Session Management](https://securitycards.rewarelabs.com/downloads/rust/actix-web/web-v4-14-0/session-management.md): Clearing session cookies or authentication state from the client browser during logout or session termination ### Axum axum.v0.8.9 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/rust/axum/axum-v0-8-9/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/access-control.md): When implementing access control, permission checks, or tenant isolation middleware and route layers in an Axum application. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/api-contract-misuse.md): When defining axum handler functions that use extractors to parse request bodies or path parameters. - [Authentication](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/authentication.md): When building Axum request extractors or middleware that must verify incoming bearer tokens or credentials before allowing route handlers to execute. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/boundary-control.md): Applying middleware that modifies request URIs or properties affecting routing decisions before requests are handled by Axum. - [Cryptography](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/cryptography.md): Handling sensitive session state, tokens, or confidential data in client cookies using axum-extra. - [CSRF](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/csrf.md): Handling OAuth authorization callback requests where state parameters must be verified against server-stored CSRF tokens. - [Deserialization](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/deserialization.md): When implementing zero-copy request parsing in Axum using `JsonDeserializer` where fields might contain escape sequences. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/input-contract-definition.md): When building request handlers in axum that receive data and require field length, numerical bounds, or string pattern safety beyond standard type deserialization. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/input-interpretation-safety.md): Extracting URL path parameters from incoming requests where percent-decoding could transform traversal sequences. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/interface-protocol-hardening.md): Configuring security headers and cross-origin resource sharing policies for HTTP responses in an axum web application. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/network-boundary.md): Binding network interfaces with `tokio::net::TcpListener` for `axum::serve` to control client access boundaries. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/output-encoding.md): Rendering dynamic user-supplied data inside `Html` response types in Axum handlers. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/resource-exhaustion.md): Building or configuring Axum HTTP routes and services that handle incoming request bodies, file uploads, or concurrent workloads. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/secret-handling.md): Configuring application state, middleware layers, or cryptographic keys that require sensitive credentials and secrets. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/security-control-integrity.md): Registering security-critical middleware layers such as authentication, authorization, or rate limiting on an Axum Router. - [Session Management](https://securitycards.rewarelabs.com/downloads/rust/axum/axum-v0-8-9/session-management.md): Managing session identifiers or authentication cookies via response headers and cookie jars in Axum handlers. ### Rocket v0.5.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/rust/rocket/v0-5-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/access-control.md): Use when implementing custom authentication, role checks, or ownership validation for Rocket route handlers to prevent unauthorized access. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/api-contract-misuse.md): When developing route handlers in Rocket that mutate session or cookie state and need to inspect those modifications within the same request lifecycle. - [Authentication](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/authentication.md): When implementing transport-layer client identity verification and requiring valid cryptographic certificates for endpoint access. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/boundary-control.md): Configuring Rocket applications that are directly internet-facing and not behind a trusted reverse proxy. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/configuration-source-integrity.md): Configuring concurrency and worker thread parameters for Rocket applications using `Config::figment()` or trusted environment variables. - [Cryptography](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/cryptography.md): Instantiating or configuring secret keys manually in the application configuration using Rocket's secret key management. - [CSRF](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/csrf.md): Configuring session cookies and handling state-changing requests or method-overridden endpoints in Rocket. - [Deserialization](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/deserialization.md): Deserializing untrusted payloads into domain or model structures using Serde where primary keys or status codes are present. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/escape-hatch.md): Defining web routes and handling parameters in a Rocket application. - [File Handling](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/file-handling.md): When serving static assets, handling multi-segment dynamic paths, processing file uploads, or mapping user-supplied input to file system paths. - [Injection](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/injection.md): When executing database queries via `rocket_db_pools` and SQL drivers like `sqlx` in Rocket request handlers. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/input-contract-definition.md): Defining form structs and validating incoming form and query parameters using Rocket's ` - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/input-driven-boundary-selection.md): Building HTTP redirect responses where untrusted input or dynamic values might otherwise be passed directly into redirect constructors. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/input-interpretation-safety.md): Parsing, decoding, normalizing, or validating untrusted URIs, query strings, and input parameters to prevent path ambiguity, parser differentials, and validation bypasses. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/interface-protocol-hardening.md): When crafting HTTP responses in Rocket that require protocol-level headers or when registering protocol upgrade handlers. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/network-boundary.md): When deploying a Rocket application behind a reverse proxy or load balancer and handling client IP addresses for network boundary enforcement. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/output-encoding.md): When rendering dynamic or user-controlled content inside `rocket::response::content::RawHtml` responses. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/resource-exhaustion.md): Configuring global data limits, handling file uploads, or processing incoming streams and form payloads in Rocket applications. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/runtime-environment-hardening.md): Configuring the Rocket application for production deployment to ensure secure runtime settings and default protective header injection. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/secret-handling.md): Configuring cryptographic secret keys, handling encrypted private cookies, and managing sensitive authentication tokens or credentials in Rocket applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/security-control-integrity.md): When registering global fairings, custom Shield policies, and request/response interceptors in a Rocket application. - [Session Management](https://securitycards.rewarelabs.com/downloads/rust/rocket/v0-5-1/session-management.md): Developing authentication, session management, or stateful cookie handling features using Rocket's `CookieJar`. ### Salvo v0.94.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/rust/salvo/v0-94-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/access-control.md): Developing and configuring cross-origin resource sharing (CORS) security headers, preflight caching, and origin boundaries in Salvo applications. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/api-contract-misuse.md): When constructing HTTP redirects using untrusted or dynamically computed input data in Salvo handlers. - [Authentication](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/authentication.md): Setting up JWT authentication or token decoders in Salvo applications to authenticate clients and verify credentials. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/boundary-control.md): Structuring the router tree to ensure that authentication and authorization hoops are only applied to protected routes and do not inadvertently enclose public endpoints. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/configuration-source-integrity.md): Configuring Swagger UI endpoints in Salvo OpenAPI integrations where untrusted users could manipulate configuration parameters via URL query parameters. - [Cryptography](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/cryptography.md): When storing or verifying user credentials and passwords in Salvo database examples or applications. - [CSRF](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/csrf.md): Developing state-changing APIs and web routes in Salvo that require protection against cross-site request forgery using tokens, session stores, custom finders, and secure cookie configurations. - [File Handling](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/file-handling.md): Configuring static asset directories, file upload storage stores, or local file handling paths in Salvo applications. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/input-contract-definition.md): When defining request data transfer objects, parameters, and schema structures using Salvo's OpenAPI integration macros to ensure malformed input is rejected. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/input-interpretation-safety.md): Configuring proxy routing in Salvo to handle upstream requests safely and prevent attackers from bypassing security controls via encoded or relative path components. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/interface-protocol-hardening.md): Configuring network connection settings, transport negotiation protocols, and request timeouts in Salvo applications. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/network-boundary.md): Configuring rate-limiting, proxy routing, or client origin identification behind network load balancers or reverse proxies where incoming request headers can be manipulated. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/output-encoding.md): Rendering dynamic variables retrieved from session states or flash messages into HTML responses using `Text::Html` in Salvo handlers. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/resource-exhaustion.md): When defining routes and handling incoming requests in Salvo to prevent resource exhaustion from large payloads or unbounded path parameters. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/secret-handling.md): When configuring authentication, session handlers, JWT decoders, or encrypted keys in Salvo applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/security-control-integrity.md): When writing custom authentication handlers or middleware in Salvo that need to reject unauthorized requests and prevent downstream handler execution. - [Session Management](https://securitycards.rewarelabs.com/downloads/rust/salvo/v0-94-0/session-management.md): Configuring session handling in Salvo applications deployed behind an upstream proxy or load balancer that terminates TLS. ## Swift Language catalog: https://securitycards.rewarelabs.com/llms/swift.txt All Swift cards: https://securitycards.rewarelabs.com/downloads/swift.md ### Swift Crypto 4.5.1 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/swift/swift-crypto/4-5-1/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/api-contract-misuse.md): When establishing secure hybrid public-key encryption (HPKE) communications between sender and recipient endpoints. - [Authentication](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/authentication.md): Implementing hybrid public-key encryption workflows requiring identity verification and sender authentication. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/configuration-source-integrity.md): Configuring directory paths and environment variable overrides for hash-based X.509 certificate and CRL resolution. - [Cryptography](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/cryptography.md): You are deriving encryption keys from user passwords or hashing passwords using PBKDF2 or Scrypt primitives in CryptoExtras and BoringSSL. - [Deserialization](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/deserialization.md): Parsing DER-encoded ASN.1 data structures containing timestamps from untrusted sources. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/input-contract-definition.md): Instantiating cryptographic keys, nonces, or sealed boxes from external or raw binary inputs. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/input-interpretation-safety.md): Decoding low-level ASN.1 data structures, encoded public/private keys, or PKCS - [Memory Safety](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/memory-safety.md): When managing input and output memory buffers for low-level cryptographic primitives, key derivation, or block cipher operations. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/resource-exhaustion.md): Parsing RSA keys from external sources to prevent excessive computational resource consumption. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/runtime-environment-hardening.md): Configuring process sandboxing and system access restrictions in applications utilizing underlying cryptographic components. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/secret-handling.md): When managing derived keys, shared secrets, and private key representations in application workflows. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/swift/swift-crypto/4-5-1/security-control-integrity.md): Configuring X509 verification parameters where unauthorized or unsupported verification flags could cause verification failures or fail-closed behavior. ### Vapor 4.122.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/swift/vapor/4-122-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/access-control.md): Enforcing role or permission checks to determine whether an authenticated user may access a protected route or tenant resource in Vapor. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/api-contract-misuse.md): Developing route closures and handling incoming requests where request-bound services such as `req.client` must be accessed. - [Authentication](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/authentication.md): Authenticating users with credentials or verifying incoming JWT bearer tokens in Vapor. - [Cryptography](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/cryptography.md): When generating high-entropy random values for bearer tokens, API credentials, or symmetric keys. - [CSRF](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/csrf.md): Configuring session middleware and cookie factories for routes that use ambient credentials and state-changing actions. - [File Handling](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/file-handling.md): Configuring `FileMiddleware` for serving static assets in a Vapor application. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/input-contract-definition.md): Validating untrusted HTTP request content, query parameters, or JSON payloads against explicit type, range, format, and requirement rules before executing business logic. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/input-interpretation-safety.md): You are verifying incoming request content types and security controls depend on specific parameters like character encodings. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/interface-protocol-hardening.md): Handling incoming HTTP request headers or setting outgoing response headers where case sensitivity could lead to protocol confusion or security control bypasses. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/network-boundary.md): When configuring network boundaries or routing endpoints that handle Basic authentication and credentials. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/output-encoding.md): Building HTTP responses or rendering dynamic templates with user-supplied data in Vapor. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/resource-exhaustion.md): Configuring routes that handle incoming HTTP request payloads and file uploads to prevent resource exhaustion. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/runtime-environment-hardening.md): Configuring global middleware and application error handling during server bootstrap to ensure internal error details are properly masked in production. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/secret-handling.md): When loading API keys, cryptographic secrets, or database credentials in Vapor route handlers and configuration setups. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/security-control-integrity.md): Configuring the application middleware chain in Vapor to ensure cross-origin resource sharing headers are correctly applied to error and abort responses. - [Session Management](https://securitycards.rewarelabs.com/downloads/swift/vapor/4-122-0/session-management.md): Configuring session cookie attributes, registering session middleware, and terminating user sessions in Vapor applications. ## TypeScript Language catalog: https://securitycards.rewarelabs.com/llms/typescript.txt All TypeScript cards: https://securitycards.rewarelabs.com/downloads/typescript.md ### Bullmq v5.81.3 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/typescript/bullmq/v5-81-3/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/access-control.md): When manually fetching jobs from a queue and performing custom state transitions or lock extensions. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/api-contract-misuse.md): When defining worker processor functions, custom Lua scripts, or handling cancellation tokens where exact parameter signatures and key counts are required by BullMQ APIs. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/boundary-control.md): When implementing or managing explicit job lock extensions and concurrency control across distributed worker instances. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/configuration-source-integrity.md): Initializing BullMQ components such as `Queue` or `Worker` using configuration parameters derived from environment variables or external sources. - [Cryptography](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/cryptography.md): When instantiating a Queue in BullMQ and configuring repeatable job key generation settings to meet compliance standards. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/dangerous-execution.md): Instantiating a `Worker` with a sandboxed file path or URL processor where processor paths must be configured securely. - [File Handling](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/file-handling.md): Configuring path mappings or loading Lua scripts from directory paths where untrusted input could influence filesystem paths. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/input-contract-definition.md): Enforcing input validation and schema structures on queue names, cron expressions, timezones, and scheduler end dates before registering tasks or instantiating components in BullMQ. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/input-interpretation-safety.md): When validating, sanitizing, and restricting numeric formats in job payload dictionaries or scheduler data before serialization. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/network-boundary.md): Configuring network access and connection endpoints for BullMQ producers and workers connecting to Redis or AWS MemoryDB. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/resource-exhaustion.md): When managing finalized jobs in Redis to prevent unbounded storage growth and memory exhaustion. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/runtime-environment-hardening.md): When instantiating sandboxed job processors in BullMQ to isolate execution and prevent resource leaks or unintended environment variable inheritance. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/secret-handling.md): Configuring Redis connection parameters, client options, or private registries when initializing BullMQ queues, workers, or package managers. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/typescript/bullmq/v5-81-3/security-control-integrity.md): Configuring worker locks and handling lock renewal failures to ensure jobs fail closed and prevent concurrent duplicate execution. ### Drizzle Orm 0.45.2 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/typescript/drizzle-orm/0-45-2/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/access-control.md): Developing database queries, defining table policies, or creating database views in multi-tenant or protected environments where unauthorized access across boundaries must be prevented. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/api-contract-misuse.md): When writing transactional boundaries and executing multi-statement operations across various database drivers in Drizzle ORM. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/boundary-control.md): Applying query caching and custom cache tags in application database queries where data from multiple users or tenants crosses application boundaries. - [Injection](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/injection.md): When building custom SQL queries, database clauses, or expressions where dynamic values or user input must be included securely. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/input-contract-definition.md): When validating HTTP request payloads, CLI options, database schema snapshots, and serialized configuration inputs before processing application data. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/network-boundary.md): When configuring custom HTTP proxy drivers to handle database queries over network boundaries. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/resource-exhaustion.md): Executing multi-statement transactional database queries where connection leaks could exhaust the connection pool and cause service downtime. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/secret-handling.md): Configuring database connections, CLI schemas, or logging options where secrets, tokens, and query parameters are exposed. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/typescript/drizzle-orm/0-45-2/security-control-integrity.md): When managing database transactions in SQLite with `db.transaction()` and handling errors inside transaction callbacks. ### Helmet v8.3.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/typescript/helmet/v8-3-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/0_security_blueprint.md - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/api-contract-misuse.md): When initializing Helmet middleware or standalone sub-middleware functions and passing configuration objects and options. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/boundary-control.md): When configuring Express server boundaries to control how untrusted third-party websites can embed and read application resources. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/escape-hatch.md): Configuring Content Security Policy in Helmet when an advanced edge case requires explicitly omitting the default-src fallback directive. - [Injection](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/injection.md): When configuring Content Security Policy directives in helmet to prevent script injection without enabling unsafe inline scripts. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/input-contract-definition.md): When configuring cross-origin policy settings such as crossOriginOpenerPolicy to ensure allowed input values conform to explicit specifications. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/input-interpretation-safety.md): Configuring Content Security Policy directives using Helmet in an Express application to ensure reserved keywords are interpreted securely by browsers. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/interface-protocol-hardening.md): Use when configuring transport security headers and content security policies to prevent protocol downgrade attacks and ensure secure client communication. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/runtime-environment-hardening.md): Configuring the production runtime and process environment to reduce attack surface and avoid revealing framework implementation details. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/typescript/helmet/v8-3-0/security-control-integrity.md): Registering Helmet as global middleware in an Express application to ensure security header controls remain consistently applied across all execution paths. ### Hono v4.12.32 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/typescript/hono/v4-12-32/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/access-control.md): When restricting endpoint access by source IP addresses using allow lists and deny lists in Hono applications. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/api-contract-misuse.md): Building and configuring exception handlers, middleware stacks, and route logic to process runtime errors and authentication failures safely. - [Authentication](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/authentication.md): Securing Hono endpoints with HTTP Basic Authentication or bearer tokens while preventing timing side-channels and unauthenticated access. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/boundary-control.md): Storing and retrieving per-request metadata and authentication state across Hono middleware boundaries. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/configuration-source-integrity.md): Importing Hono modules into Deno runtimes for application development. - [Cryptography](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/cryptography.md): When performing cryptographic operations, hashing, signature verification, or signing data using Hono utilities and Web Crypto APIs. - [CSRF](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/csrf.md): Building web applications or APIs with Hono where state-changing requests using ambient credentials require origin and request header validation. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/escape-hatch.md): Rendering dynamic or user-provided HTML content via `dangerouslySetInnerHTML` in Hono JSX components. - [File Handling](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/file-handling.md): When configuring static file serving middleware or static site generation helpers to prevent unauthorized access and protect target output directories. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/input-contract-definition.md): Handling incoming JSON, form payloads, and localized language configurations where input validation and allowed structures must be strictly enforced. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/input-driven-boundary-selection.md): Developing Hono applications that require secure routing boundaries, wildcard middleware paths, and sub-applications. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/input-interpretation-safety.md): Extracting request metadata, parameters, and query strings in Hono where input dictionaries use prototype-less objects. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/interface-protocol-hardening.md): Enforcing HTTP response security headers, Content Security Policy directives, and secure nonce generation for inline scripts in Hono applications. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/network-boundary.md): When configuring IP restriction middleware to control network reachability based on client addresses. - [Output Encoding](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/output-encoding.md): When combining styled utility classes with dynamic or external class strings in Hono applications. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/resource-exhaustion.md): Handling incoming HTTP requests and processing request bodies in Hono applications, particularly when deployed on serverless environments like AWS Lambda. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/secret-handling.md): When configuring authentication, environment variables, or platform secrets in Hono applications. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/security-control-integrity.md): Configuring cross-origin resource sharing (`cors`) or server-timing (`timing`) middleware headers for untrusted origins. - [Session Management](https://securitycards.rewarelabs.com/downloads/typescript/hono/v4-12-32/session-management.md): Use when configuring cookie-based session identifiers or handling session-related tokens in Hono routes to prevent session tampering and domain injection. ### Mongoose 9.8.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/typescript/mongoose/9-8-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/access-control.md): When saving documents in Mongoose where updating existing records could bypass tenant ownership or authorization boundaries. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/api-contract-misuse.md): When executing database transactions and handling modifications on partial or subdocument query results. - [Authentication](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/authentication.md): Establishing a database connection in Mongoose that requires user credentials and explicit authentication settings. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/boundary-control.md): Implementing deletion middleware or security hooks to ensure boundary checks execute correctly across document and query operations. - [Cryptography](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/cryptography.md): Defining schemas with sensitive paths requiring cryptographic protection and initializing database connections with key management configurations. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/dangerous-execution.md): When performing update queries in Mongoose where untrusted input might otherwise be passed to `updatePipeline`. - [Escape Hatch](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/escape-hatch.md): performing routine database operations and handling untrusted data to ensure schema validation, type casting, and middleware hooks remain enforced - [Injection](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/injection.md): Building Mongoose queries or aggregation pipelines using user-supplied input where unvalidated structures or concatenated strings can lead to injection. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/input-contract-definition.md): Defining schemas and processing external input payloads to prevent mass assignment and ensure valid data types, enums, ranges, and required properties. - [Input Driven Boundary Selection](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/input-driven-boundary-selection.md): When defining schemas that use dynamic document references via `refPath` to populate documents from untrusted sources. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/input-interpretation-safety.md): Handling untrusted user inputs or query parameters in Mongoose schemas, queries, and validation workflows. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/network-boundary.md): Configuring database cluster network connections and firewall rules to restrict network access. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/resource-exhaustion.md): Developing database queries and operations that require protection against unbounded execution times and denial-of-service conditions. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/runtime-environment-hardening.md): Configuring database connections and handling connection failures during application startup and runtime. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/secret-handling.md): Configuring database connections and defining schema projections in Mongoose. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/typescript/mongoose/9-8-0/security-control-integrity.md): When configuring schema options, query update filters, and discriminator models to prevent unauthorized data modifications and control bypasses. ### Nest v11.1.28 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/typescript/nest/v11-1-28/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/access-control.md): Implementing role-based authorization, guard binding, or tenant context that varies between incoming requests. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/api-contract-misuse.md): When documenting NestJS APIs using OpenAPI (Swagger) decorators such as `@ApiSecurity` or `@ApiBearerAuth`. - [Authentication](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/authentication.md): Implementing JWT-based token authentication, route guards, and custom header parsing in NestJS applications. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/boundary-control.md): Designing error-handling policies and configuring exception filters in NestJS applications. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/configuration-source-integrity.md): Configuring monorepo tooling scripts, managing external dependencies, or querying package metadata during build or initialization in NestJS applications. - [Cryptography](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/cryptography.md): Implementing user authentication and credential verification workflows in a NestJS application. - [File Handling](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/file-handling.md): When configuring static asset hosting within a NestJS application using @nestjs/serve-static. - [Injection](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/injection.md): When querying or mutating database records with TypeORM in NestJS services. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/input-contract-definition.md): Defining incoming request shapes and DTOs for NestJS HTTP endpoints and GraphQL resolvers. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/input-interpretation-safety.md): Configuring route-level security middleware and authorization policies in NestJS applications. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/network-boundary.md): When bootstrapping a NestJS application and launching the HTTP listener using NestFactory. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/resource-exhaustion.md): Implementing Server-Sent Events (SSE) or managing persistent connections in NestJS applications using Express or Fastify. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/runtime-environment-hardening.md): Bootstrapping a NestJS application using `@nestjs/core` and governing runtime modes. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/secret-handling.md): Configuring modules, database providers, or authentication handlers in NestJS that require sensitive credentials or cryptographic keys. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/security-control-integrity.md): When configuring routing-level security controls, including middleware binders, routing prefixes, path exclusions, and multi-method routing. - [Session Management](https://securitycards.rewarelabs.com/downloads/typescript/nest/v11-1-28/session-management.md): When implementing a custom provider whose lifetime must be tied to one incoming request. ### Prisma 7.8.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/typescript/prisma/7-8-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/access-control.md): When implementing data access logic in applications using Prisma, especially for operations that modify or retrieve sensitive information. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/api-contract-misuse.md): Executing database operations within Prisma's interactive transactions. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/configuration-source-integrity.md): Setting up Prisma migrations, managing database credentials, or configuring the migration environment. - [Cryptography](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/cryptography.md): Using cryptographic functions like hashing or random number generation within your application, especially when leveraging Prisma's compatibility layers. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/dangerous-execution.md): When executing raw SQL queries or commands directly against the database. - [Injection](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/injection.md): When interacting with the database using Prisma Client, especially when constructing queries with user-provided data. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/input-interpretation-safety.md): When manually constructing query plans or extensions in Prisma Client, especially when dealing with specialized data types. - [Interface Protocol Hardening](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/interface-protocol-hardening.md): Initializing PrismaClient in Prisma version 7.8.0. - [Network Boundary](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/network-boundary.md): Configuring Prisma Client to connect to a database, especially when using HTTP-based adapters or custom network configurations. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/resource-exhaustion.md): When querying data with Prisma, especially for large datasets or complex relationships. - [Runtime Environment Hardening](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/runtime-environment-hardening.md): When developing or deploying applications using Prisma, especially in production environments. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/secret-handling.md): Configuring database connections or other sensitive settings in Prisma, especially after version 7.0.0. - [Security Control Integrity](https://securitycards.rewarelabs.com/downloads/typescript/prisma/7-8-0/security-control-integrity.md): When performing sensitive database operations that require strict data consistency and atomicity, especially within transactions. ### Type Orm 1.1.0 — latest supported - Canonical library page: https://securitycards.rewarelabs.com/libraries/typescript/type-orm/1-1-0/ - Combined Markdown bundle: https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0.md - Security Blueprint: https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/0_security_blueprint.md - [Access Control](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/access-control.md): Configuring database connections in applications where write access is not required or should be restricted to enforce tenant isolation and least privilege access. - [API Contract Misuse](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/api-contract-misuse.md): Calling TypeORM repository, entity manager, query builder, and transaction methods where specific arguments, types, call orders, criteria objects, and lock options are required. - [Authentication](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/authentication.md): Configuring database connections and authentication options in TypeORM for enterprise or cloud-hosted environments. - [Boundary Control](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/boundary-control.md): When performing queries that evaluate access control checks or rely on recently written state in a replicated database environment. - [Configuration Source Integrity](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/configuration-source-integrity.md): Initializing TypeORM DataSource configurations for production and development environments. - [Dangerous Execution](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/dangerous-execution.md): Configuring MongoDB database connections using `DataSource` in TypeORM. - [Injection](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/injection.md): When configuring parameter maps or object literals for database query execution across TypeORM drivers. - [Input Contract Definition](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/input-contract-definition.md): When validating entity attributes and enforcing schema constraints using class-validator before saving data to the database using TypeORM. - [Input Interpretation Safety](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/input-interpretation-safety.md): Writing input validation logic before persisting data into simple-array columns in TypeORM entities. - [Resource Exhaustion](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/resource-exhaustion.md): Configuring database connections and executing queries in TypeORM to bound execution time and prevent resource starvation. - [Secret Handling](https://securitycards.rewarelabs.com/downloads/typescript/type-orm/1-1-0/secret-handling.md): When defining entity columns that store sensitive data or when configuring connection URLs with special characters.