SecurityThoughtful defenses.
Thoughtful defenses.
Clear responsibilities.
Understand the protections built into bext, the security headers it supports, and how to report a vulnerability responsibly.
Report a vulnerabilityFIG. 11 / SECURITY
Another side of the engine.
IN THIS CHAPTER01Defense in depth02Responsible disclosure03Security headers
On this page
Reporting Vulnerabilities
Warning
Do not open public GitHub issues for security vulnerabilities. Email security@bext.dev with details.
We aim to respond within 48 hours and provide a fix within 7 days for critical issues.
Built-in Security Features
WAF
SQLi/XSS detection, IP filtering, geo-blocking, bot protection
TLS
Auto-ACME, HSTS, OCSP stapling
Plugin Sandbox
WASM, QuickJS, nsjail isolation tiers
SSRF Prevention
Built-in safeguards for server actions
Rate Limiting
Token bucket per-IP rate limiting
Security Headers
bext sets these headers by default on all responses:
Strict-Transport-SecurityX-Content-Type-Options: nosniffX-Frame-Options: DENYReferrer-Policy: strict-origin-when-cross-origin