Application security

Use CSP, CSRF, Trusted Types, session hardening, validation, origin checks, upload restrictions, encryption, request limits, and explicit CORS. See the security policy for reporting.

Practical example

Enable the main browser and request protections in application configuration, then audit the resolved production profile.

// wrnexus.config.ts
export default {
  security: {
    contentSecurityPolicy: true,
    csrf: true,
    trustedTypes: true,
    frameOptions: "deny",
    referrerPolicy: "strict-origin-when-cross-origin",
    requestLimit: { maxBytes: 1_048_576 },
    cors: { origins: ["https://app.example.com"] },
  },
};

bunx wrnexus config . --explain --profile=production
bunx wrnexus security audit .

What to verify

Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.

Configuration

Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.

Implementation workflow

bunx wrnexus doctor .
bunx wrnexus typecheck .
bunx wrnexus inspect routes .
bunx wrnexus build .

Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.

Verification checklist

• Inputs are validated at the authoritative server boundary.
• Authentication and resource authorization are tested independently.
• Generated routes and application types are current.
• Error, empty, loading, denied, and success states are documented.
• The production artifact starts and serves the expected route.

Release scope

This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.

Browse package APIs · CLI reference · Troubleshooting · Support