@boldsec/express

Live BOLA/IDOR monitoring for Express. Add one middleware; BoLD watches your API and raises an alarm the moment one user reaches another user's object, in real time, from your app's actual traffic.

• Metadata only. BoLD receives who made the request (an opaque, non-reversible handle, never the token), the endpoint shape, the object id, the status, and the object's declared owner if the response exposed one. The response body is read once to extract that single owner field and then discarded. No body, no headers, no credentials ever leave your app.
• Fail-safe. Shipping the metadata is fire-and-forget. If BoLD is slow or down, your response is returned untouched and on time. BoLD can never break or slow the app it watches.
• Never alters your response. Your handlers run exactly as before; responses are returned byte for byte.

Install

npm install @boldsec/express

Requires Express 4.16 or newer (tested through Express 5).

Configure (once)

Add your keys from the BoLD Live page (shown once when you connect the app):

BOLD_INGEST_URL=https://<your-bold>/api/live/ingest
BOLD_INGEST_KEY=blk_...
# optional: owner-field names to look for in responses (default covers common ones)
BOLD_OWNER_FIELDS=ownerId,owner_id,user_id

Use

Register the middleware once, after your body parser:

import express from "express";
import { boldExpress } from "@boldsec/express";

const app = express();
app.use(express.json());

app.use(boldExpress({
  resolveCallerId: (req) => req.user?.id ?? null, // same namespace as the owner field
}));

resolveCallerId tells BoLD which caller made the request, in the same namespace as your owner field (usually the authenticated user id). Return null when there is no authenticated caller. If you leave it out, BoLD still watches the route but reports the caller as unknown, which shows up as a loud "needs review", never a false all-clear.

Unconfigured (no BOLD_INGEST_URL), the middleware is a transparent pass-through, so it is safe to leave wired in every environment.

What BoLD answers

One question: can one user reach another user's data or action? BoLD is a runtime alarm for the BOLA/IDOR ownership family, not a scanner. It confirms a real cross-user reach on live traffic and never guesses.

Learn more at boldsec.io.