@thelab.lat/vibecheck-shield

Real-time security shield for Node.js apps. WAF, honeypot, anti-spam, and smart rate limiting in one line.

npm i @thelab.lat/vibecheck-shield

Express

import express from "express";
import { shield } from "@thelab.lat/vibecheck-shield";

const app = express();
app.use(express.json());
app.use(shield({
  waf: true,
  honeypot: true,
  antispam: true,
  rateLimit: true,
  securityHeaders: true,
  logFile: "./vibecheck-shield.log",
  onThreat: (event) => {
    console.log("THREAT:", event);
  }
}));

Fastify

import Fastify from "fastify";
import { shield } from "@thelab.lat/vibecheck-shield";

const fastify = Fastify();
await fastify.register(shield.fastify, { waf: true, honeypot: true });

Next.js API Routes

import type { NextApiRequest, NextApiResponse } from "next";
import { shield } from "@thelab.lat/vibecheck-shield";

const middleware = shield({ waf: true, rateLimit: true, antispam: true });

export default function handler(req: NextApiRequest, res: NextApiResponse) {
  middleware(req as any, res as any, () => {
    res.status(200).json({ ok: true });
  });
}

Features | Feature | Description | | --- | --- | | WAF | Blocks SQLi, XSS, path traversal, command injection, SSRF patterns | | Honeypot | Traps common bot paths and auto-bans attackers | | Anti-spam | Detects bot UAs, missing headers, too-fast sequences, credential stuffing | | Rate limiting | Per-endpoint limits with auto-escalation ban | | Security headers | Injects critical security headers and removes X-Powered-By | | IP blocker | In-memory + persisted bans with known bad ranges |

Configuration

type ShieldOptions = {
  waf?: boolean;
  honeypot?: boolean;
  antispam?: boolean;
  rateLimit?: boolean;
  securityHeaders?: boolean;
  logFile?: string;
  onThreat?: (event) => void;
  honeypotRoutes?: string[];
  banFile?: string;
}

What it blocks

SQLi:     /login?u=admin'--&p=...
XSS:      /search?q=<script>alert(1)</script>
Traversal:/download?file=../../etc/passwd
Cmd inj:  /export?file=report.csv; rm -rf /
SSRF:     /fetch?url=http://169.254.169.254/latest/meta-data/

Notes

• No external dependencies. Built on Node.js core modules only.
• Bans persist to .vibecheck-shield/bans.json by default.