Security

SSRF protection

Use assertSafeUrl before making server-side requests to user-controlled or tenant-controlled destinations. HTTPS is the default allowed protocol, private IPv4 and IPv6 ranges are blocked by default, and production code should additionally use an explicit host allowlist.

const endpoint = assertSafeUrl(input, {
  allowedHosts: ['api.example.com'],
});

Combine URL validation with fetchWithPolicy to enforce upstream timeouts, retry budgets, and response-size limits.

export default {
  poweredBy: false,
  limits: {
    bodyBytes: 2 * 1024 * 1024,
    requestTimeoutMs: 60_000
  }
};

Production requirements

Use HTTPS, secret management, least-privilege database accounts, dependency updates, secure cookies, CSRF protection for cookie-based mutations, authorization checks, audit logging for sensitive actions, and backups.

Do not log passwords, session tokens, authorization headers, payment data, or personal data. The structured logger masks known sensitive keys, but application-specific data must still be reviewed.

Reporting vulnerabilities

Do not open a public issue for a security vulnerability. Follow the private reporting process in SECURITY.md. Include the affected version, impact, reproduction steps, and a minimal proof of concept without real credentials.

Jeston provides security mechanisms; it cannot make an application secure automatically. Review the complete data flow, dependencies, deployment, and authorization model.

Start

Core

Platform

Reference

Operations

SSRF protection

Production requirements

Reporting vulnerabilities

​SSRF protection

​Production requirements

​Reporting vulnerabilities

SSRF protection

Production requirements

Reporting vulnerabilities