@boldsec/fastify

Live BOLA/IDOR monitoring for Fastify. Register one plugin; BoLD watches your API and raises an alarm the moment one user reaches another user's object, in real time, from your app's actual traffic.

• Metadata only. BoLD receives who made the request (an opaque, non-reversible handle, never the token), the endpoint shape, the object id, the status, and the object's declared owner if the response exposed one. The response body is read once to extract that single owner field and then discarded. No body, no headers, no credentials ever leave your app.
• Fail-safe. The observation runs in onResponse, after the response is on the wire, fire-and- forget. If BoLD is slow or down, your response is returned untouched and on time. BoLD can never break or slow the app it watches.
• Never alters your response. Your handlers run exactly as before; responses are returned byte for byte.

Install

npm install @boldsec/fastify

Requires Fastify 4 or newer.

Configure (once)

Add your keys from the BoLD Live page (shown once when you connect the app):

BOLD_INGEST_URL=https://<your-bold>/api/live/ingest
BOLD_INGEST_KEY=blk_...
# optional: owner-field names to look for in responses (default covers common ones)
BOLD_OWNER_FIELDS=ownerId,owner_id,user_id

Use

Register the plugin once; its hooks apply app-wide:

import Fastify from "fastify";
import { boldFastify } from "@boldsec/fastify";

const app = Fastify();

await app.register(boldFastify({
  resolveCallerId: (req) => req.user?.id ?? null, // same namespace as the owner field
}));

resolveCallerId tells BoLD which caller made the request, in the same namespace as your owner field (usually the authenticated user id). Return null when there is no authenticated caller. If you leave it out, BoLD still watches the route but reports the caller as unknown, which shows up as a loud "needs review", never a false all-clear.

Unconfigured (no BOLD_INGEST_URL), the plugin is a transparent pass-through, so it is safe to leave registered in every environment.

What BoLD answers

One question: can one user reach another user's data or action? BoLD is a runtime alarm for the BOLA/IDOR ownership family, not a scanner. It confirms a real cross-user reach on live traffic and never guesses.

Learn more at boldsec.io.