EvoSecurity SDK

A Production-Grade, Privacy-Safe Identity & Runtime Security SDK for Node.js.

EvoSecurity protects your backend applications by analyzing runtime behavior, request patterns, and token usage to detect automation, abuse, and security anomalies—without invading user privacy.

Features

• Runtime Profiler: Detects abnormal environments (Debuggers, malicious containers).
• Behavior Analyzer: Tracks request frequency, bursts, and anomalies per IP.
• Token Guard: Detects JWT replay attacks and structural weaknesses.
• Risk Scoring: Generates a numeric risk score (0-100) with explainable reasons.
• Policy Engine: Configurable rules to Block, Log, or Challenge requests.
• Privacy First: No PII collection, no external tracking, no device fingerprinting.

Installation

npm install evosecurity

Usage

Basic Integration (Express)

import express from 'express';
import { EvoSecurity } from 'evosecurity';

const app = express();

const evo = new EvoSecurity({
  appId: 'my-app',
  policy: {
    blockOnHighRisk: true,
    maxRequestsPerMinute: 100,
    tokenReplayTolerance: 1,
    logLevel: 'verbose'
  }
});

// Apply middleware
app.use(evo.middleware());

app.get('/', (req, res) => {
  res.send('Protected by EvoSecurity');
});

app.listen(3000);

Configuration Options

| Option | Type | Default | Description | |--------|------|---------|-------------| | blockOnHighRisk | boolean | false | If true, 403s requests with High Risk. | | maxRequestsPerMinute | number | 100 | Rate limit threshold per IP. | | dryRun | boolean | false | If true, only logs risks, never blocks. |

How It Works

See DEVELOPMENT.md for a deep dive into the architecture.

Workflow Diagram

graph LR
    User[Client] -->|Request| Middleware
    Middleware --> Profiler[Runtime Profiler]
    Middleware --> Analyzer[Behavior Analyzer]
    Middleware --> Guard[Token & Session Guard]
    
    Profiler --> RiskEngine[Risk Scoring Engine]
    Analyzer --> RiskEngine
    Guard --> RiskEngine
    
    RiskEngine -->|Score| Policy[Policy Engine]
    Policy -->|Block/Allow| Response
    Response -->|403/200| User

EvoSecurity operates on the principle: "Detect misuse through behavior, not identity."

1. Collect Signals: It reads req.ip, headers, JWTs, and process state.
2. Analyze: It compares these against historical (short-term) patterns and known bad signatures.
3. Score: It computes a composite Risk Score (e.g., 85/100).
4. Decide: If the score exceeds your policy threshold, it blocks the request.

Privacy & Data

EvoSecurity is NOT spyware.

• We do not collect persistent user IDs.
• We do not fingerprint canvas, audio, or battery status.
• We do not send data to any external server. All analysis is local.

License

This project is licensed under the MIT License - see the LICENSE file for details.