@boldsec/core

The platform-neutral core that every BoLD framework adapter is built on. It holds the single source of truth for BoLD's metadata extraction and event composition, so no adapter (Next, Express, Fastify, Koa, Hono, NestJS) can ever drift on a verdict-affecting field.

You usually do not install this directly. Install the adapter for your framework instead:

• @boldsec/next for Next.js (App Router)
• @boldsec/express
• @boldsec/fastify
• @boldsec/koa
• @boldsec/hono
• @boldsec/nestjs

Each adapter is a thin translator: it reads the framework's request and response shape into one neutral observation and hands it to this core, which extracts the metadata and ships a single event. All extraction logic lives here and nowhere else, so every tap reports the same thing.

• Metadata only. The event carries an opaque, non-reversible caller handle (never the token), the endpoint shape, the object id, the status, and the object's declared owner if the response exposed one. No body, no headers, no credentials.
• Fail-safe. Every path is written so it can never throw into, slow, or alter the host app's response.

What BoLD answers

One question: can one user reach another user's data or action? BoLD is a runtime alarm for the BOLA/IDOR ownership family, not a scanner. It confirms a real cross-user reach on live traffic and never guesses.

Learn more at boldsec.io.