@wade-development/security-browser

Low-trust, browser-side companion to @wade-development/security-node.

npm install @wade-development/security-browser

Read this before you install it

A browser cannot be trusted to assert anything about security. Anyone can open devtools and post whatever they like. So this SDK is built around what it refuses to do, and most of its test suite is about refusals.

It does not take an API key. By default, events proxy through your own backend, which forwards them with the Node SDK. A key shipped to a browser is a key handed to every visitor.

It refuses a platform ingest URL outright. Pointing it directly at the ingest edge is a configuration mistake it will not carry out.

It can only send five event types, and they are all things a page is genuinely the authority on:

| Event | Meaning | | --- | --- | | application_security.csp.violation | A Content-Security-Policy report | | application_security.frontend_error | An uncaught client-side error | | application_security.integrity_failure | An SRI check failed | | api_security.input_validation.failed | Client-side validation rejected input | | session.new_device | A device this browser has not seen before |

It is an allowlist, not a denylist. authentication.login.succeeded, authentication.mfa.disabled, authorization.role.changed and every other privileged assertion cannot be sent from here — those must come from your backend, where they can be verified.

It is also rate-limited per page, because a compromised page is otherwise a free event-flooding tool against your own detection pipeline.

Usage

import { SecurityBrowser } from '@wade-development/security-browser';

SecurityBrowser.init({
  // Your own backend, which forwards to the platform with the Node SDK.
  endpoint: '/api/security-events',
});

Licence

MIT — see the LICENSE file included in this package.