Security
What the runtime enforces, where, and what it leaves to you.
This section is a list of what has been considered, so the gaps are visible. It is not a claim of completeness.
Cataract enforces a set of defaults that stay on unless a handler explicitly overrides them: bounded request parsing, normalised paths, validated response headers, escaped markup, and a content security policy on every HTML response.
In this section
- Request hardening — limits, smuggling, slow clients, paths
- Response headers — CSP, HSTS, the always-on set
- Deployment — TLS termination, proxies and what to configure
Not provided
No TLS termination, authentication, session store, rate limiting or CSRF token scheme. Cataract expects a reverse proxy for TLS; rate limiting and authentication belong in middleware you write.
Report security issues privately to the maintainers rather than in a public issue tracker.