@verriflo/secure

Drop-in, client-side security and DevTools restriction for web applications.

VerrifloSecure provides strict, path-based enforcement to prevent unauthorized inspection, debugging, and content scraping. It is designed to be lightweight, incredibly difficult to bypass, and completely invisible in your dependency tree.

Note: This is a commercial package. A valid Verriflo Organization ID is required for initialization.

Features

• 🛡️ DevTools Blocking: Detects and aggressively blocks browser developer tools across all major browsers.
• 📍 Granular Routing: Enable protection only where you need it (e.g., ['/dashboard/*', '/checkout']).
• 📋 Scraping Prevention: Disable copy, cut, paste, and text selection on sensitive routes.
• ⚡ Zero Overhead: The initialization and license check are optimized to prevent blocking your main thread.
• 🔒 Tamper Resistant: Self-defending logic prevents users from pausing execution or stepping through the security code.

Installation

pnpm add @verriflo/secure

Quick Start

Initialize Verriflo Secure as early as possible in your application lifecycle (e.g., in main.ts, index.js, or _app.tsx):

import VerrifloSecure from "@verriflo/secure";

VerrifloSecure.init({
  licenseKey: "your-organization-id", // Required
  disablePaths: ["*"], // Block DevTools globally
  disableCopyPaths: ["/premium-content/*"], // Block copying on specific routes
  onDevToolOpen: (type, next) => {
    // Optional: Log attempts to your own backend
    console.warn(`Security alert: DevTools opened via ${type}`);

    // Call next() to proceed with the default blocking behavior
    next();
  },
});

Configuration API

| Option | Type | Default | Description | | :------------------- | :--------- | :-------------- | :---------------------------------------------------------- | | licenseKey | string | undefined | Required. Your active Verriflo Organization ID. | | disablePaths | string[] | [] | Array of route patterns where DevTools are blocked. | | disableCopyPaths | string[] | [] | Array of route patterns where copying text is blocked. | | disableCutPaths | string[] | [] | Array of route patterns where cutting text is blocked. | | disablePastePaths | string[] | [] | Array of route patterns where pasting is blocked. | | disableSelectPaths | string[] | [] | Array of route patterns where text highlighting is blocked. | | onDevToolOpen | function | undefined | Callback fired when an inspection attempt is caught. | | blockedUrl | string | 'about:blank' | Where to redirect the user if they force-open DevTools. |

Network Behavior & Edge Cases

Because @verriflo/secure verifies your license key at runtime, it makes a single, lightweight, asynchronous request on initialization.

• If the license is valid, the security policies are silently enforced.
• If the license key is invalid, expired, or the network request is intentionally blocked by the client, the security module will fail closed and log a standard error to the console.

License

Commercial Proprietary License. See LICENSE for exact terms. Unauthorized copying, decompilation, or redistribution is strictly prohibited.