@chain305/x-security 0.4.3 → 0.5.0

package/README.md

@@ -1,8 +1,8 @@
 # x-security CLI
 
 **Most teams run their API gateway and WAF on defaults.** The security is
-already in the box — authentication, rate limits, request validation,
-ownership/BOLA checks — but turning it on means learning each vendor's config
+already in the box (authentication, rate limits, request validation,
+ownership/BOLA checks), but turning it on means learning each vendor's config
 DSL, and the rules you write lock you into that vendor and drift out of sync
 with your code.
 
@@ -10,10 +10,10 @@ with your code.
 OpenAPI spec you already have.** It versions in git, diffs like code, and a
 deterministic CLI compiles it to whichever gateway you run.
 
-- **No new DSL** — policy lives in your OpenAPI file, next to the route it protects.
-- **No vendor lock-in** — one spec compiles to Kong, Coraza, BunkerWeb, OpenAppSec, Envoy, or a firewall bundle. Switch gateways without rewriting a line of policy.
-- **No config drift** — the spec is the source of truth; `validate` fails CI when the running gateway drifts from it.
-- **Deterministic** — no LLM calls, no API keys. It compiles exactly what your spec says, and nothing it can't verify.
+- **No new DSL.** Policy lives in your OpenAPI file, next to the route it protects.
+- **No vendor lock-in.** One spec compiles to Kong, Coraza, BunkerWeb, OpenAppSec, Envoy, or a firewall bundle. Switch gateways without rewriting a line of policy.
+- **No config drift.** The spec is the source of truth; `validate` fails CI when the running gateway drifts from it.
+- **Deterministic.** No LLM calls, no API keys. It compiles exactly what your spec says, and nothing it can't verify.
 
 ## Install
 
@@ -107,7 +107,7 @@ Run `xsecurity <command> --help` for full flags.
 | `envoy` | Envoy (ext_proc / Lua filter) | self-hosted bundle | alpha |
 | `firewall` | Host firewall (iptables) | self-hosted bundle | SSRF egress only¹ |
 
-¹ `firewall` is L3/L4 — it enforces only API7 SSRF egress via `domainAllowlist`; it can't introspect HTTP, so it's not on the coverage matrix below.
+¹ `firewall` is L3/L4: it enforces only API7 SSRF egress via `domainAllowlist`; it can't introspect HTTP, so it's not on the coverage matrix below.
 
 ### OWASP API Top 10 coverage per target
 
@@ -126,7 +126,7 @@ How much of each class a target can **enforce natively**. 🟢 full · 🟡 part
 | API9 · Improper Inventory Management | 🔴 | 🔴 | 🟡 |
 | API10 · Unsafe Consumption of APIs | 🟡 | 🟡 | 🟡 |
 
-Only these three targets are independently **measured** today; Kong, Coraza, NGINX, Envoy and OpenAppSec compile the same policy but aren't yet published with a per-class measurement (⚪). Cells like **🔴→🟢** are the same control stateless vs. with a JWT identity wired — ownership checks (BOLA/BFLA) need to know who the caller is, so a stateless WAF can't enforce them. A **🟡** means the target enforces most of the class natively, not all. Full per-field matrix (incl. the x-security-native injection / prompt-injection / audit classes): **[usewaf.com/coverage](https://usewaf.com/coverage)**.
+Only these three targets are independently **measured** today; Kong, Coraza, NGINX, Envoy and OpenAppSec compile the same policy but aren't yet published with a per-class measurement (⚪). Cells like **🔴→🟢** are the same control stateless vs. with a JWT identity wired. Ownership checks (BOLA/BFLA) need to know who the caller is, so a stateless WAF can't enforce them. A **🟡** means the target enforces most of the class natively, though not all of it. Full per-field matrix (incl. the x-security-native injection / prompt-injection / audit classes): **[usewaf.com/coverage](https://usewaf.com/coverage)**.
 
 ## License