securenow 8.20.2 → 8.21.0

package/NPM_README.md

@@ -1755,7 +1755,7 @@ proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-Proto $scheme;
 ```
 
-SecureNow trusts private, loopback, and same-host proxy peers automatically. For external load balancers or public proxy IPs, add them to `config.networking.trustedProxies` in `.securenow/runtime.json` or the mounted runtime credentials file. If no forwarded header reaches the app, SecureNow can detect the attack shape but cannot recover the real visitor IP from traces.
+SecureNow trusts private, loopback, and same-host proxy peers automatically. For external load balancers or public proxy IPs, add them to `config.networking.trustedProxies` in `.securenow/runtime.json` or the mounted runtime credentials file: exact IPs, IPv4 ranges such as `"203.0.113.0/24"`, or `"cloudflare"` for Cloudflare's published edge ranges (8.21.0+). If no forwarded header reaches the app, SecureNow can detect the attack shape but cannot recover the real visitor IP from traces. Starter protection refuses block mode for an app whose traffic arrives through a proxy it doesn't trust, because a block would hit the proxy and everyone behind it.
 
 **Check 6: Using PM2?**
 

package/SKILL-CLI.md

@@ -476,6 +476,21 @@ securenow firewall test-ip <ip> --app <key> --env local  # check if IP would be
 
 **Zero-config setup:** running `securenow app connect` enables the selected app's firewall toggle, auto-mints a runtime API key (scoped `traces:write + logs:write + firewall:read + blocklist:read + allowlist:read`), and writes it to `.securenow/runtime.json` after the app is selected. No `SECURENOW_API_KEY` env var needed. If the user already has a key, `securenow api-key set snk_live_...` achieves the same thing; if they only have admin auth, `securenow api-key create` mints and saves a fresh runtime key. See [the landing firewall page](https://securenow.ai/firewall) for an overview.
 
+### Starter Protection — Rules Every App Gets
+
+An app gets the starter pack when it is created or first sends traffic: about 20 rules (SQL injection, XSS, traversal, command and template injection, Log4Shell, Spring4Shell, metadata SSRF, CRLF, prototype pollution, `.env`/`.git`/backup probes, exploit kits, attack-tool user agents, body payloads, failed sign-ins, 404 scanning). They start in **monitor** mode: they alert, nothing is blocked by them. In **block** mode the 14 block-ready rules block the address for 6 hours on their exploit signatures (URL, headers, user agent; bodies and the scheduled rules only alert).
+
+```bash
+securenow protect                         # status of the current app: mode, rules, alerts, ready to block?
+securenow protect status --all --json     # every app
+securenow protect enable --app <key>      # turn it on (monitor mode)
+securenow protect block --app <key>       # a person turns blocking on; refused unless the app sees real client IPs
+securenow protect monitor --app <key>     # back to alerts only
+securenow protect disable --app <key>     # off; stays off until someone turns it on
+```
+
+Only a person signed in (`securenow admin login`) can turn blocking on; API keys, MCP connectors and the agent get a 403. Blocking is refused when more than 20% of the app's traffic reaches it through a proxy the SDK doesn't trust: add the proxy to `config.networking.trustedProxies` (IPs, IPv4 ranges or `"cloudflare"`). Tune a noisy starter rule like any rule (exclusions, `alerts rules update`); pack updates never overwrite a rule a person edited.
+
 ### Blocklist — Block Malicious IPs
 
 ```bash

package/app-config.js

@@ -133,7 +133,7 @@ const CONFIG_EXPLANATIONS = Object.freeze({
   'config.firewall.cloudflare': 'Cloudflare API token/account id for Layer 4 WAF. Secrets: do not commit.',
   'config.firewall.aws': 'AWS WAF IP set configuration for Layer 4 WAF.',
   'config.firewall.gcp': 'GCP Cloud Armor policy configuration for Layer 4 WAF.',
-  'config.networking.trustedProxies': 'Additional proxy IPs whose X-Forwarded-For headers should be trusted.',
+  'config.networking.trustedProxies': 'Additional proxies whose X-Forwarded-For headers should be trusted: IPs, IPv4 ranges (CIDR) or "cloudflare".',
 });
 
 function clone(value) {

package/cli/protect.js

@@ -0,0 +1,137 @@
+'use strict';
+
+// securenow protect: the starter protection every app gets (API: /protection). Monitor mode alerts; block mode
+// also blocks the exploit signatures of the block-ready rules, and only a person turns it on.
+
+const { api, requireAuth } = require('./client');
+const ui = require('./ui');
+
+function resolveAppKey(flags) {
+  if (flags && flags.app) return String(flags.app);
+  try {
+    const { resolveAppKey: fromConfig } = require('../app-config');
+    return fromConfig() || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function requireApp(flags) {
+  const appKey = resolveAppKey(flags);
+  if (!appKey) {
+    ui.error('No app selected. Pass --app <key> or run `securenow app connect` / `securenow apps default <key>`.');
+    process.exit(1);
+  }
+  return appKey;
+}
+
+function modeLabel(app) {
+  if (app.mode === 'block') return ui.c.green('BLOCK');
+  if (app.mode === 'monitor') return ui.c.cyan('MONITOR');
+  return ui.c.yellow(app.state === 'unset' ? 'NOT YET ON' : 'OFF');
+}
+
+function printApp(app, { verbose }) {
+  console.log('');
+  console.log(`  ${ui.c.bold(app.appName)} ${ui.c.dim(app.appKey)}  ${modeLabel(app)}`);
+  const summary = app.summary || {};
+  ui.keyValue([
+    ['Rules', `${summary.active || 0} active of ${summary.rules || 0} (${summary.blockReady || 0} can block, ${summary.blocking || 0} blocking)`],
+    ['Alerts, last 7 days', `${summary.alerts7d || 0} (${summary.falsePositives7d || 0} marked false positive)`],
+    ['Pack version', `${app.packVersion || '-'} (latest ${app.latestPackVersion})${summary.customized ? `, ${summary.customized} rule(s) edited by a person` : ''}${summary.missing ? `, ${summary.missing} missing` : ''}`],
+  ]);
+  if (app.mode === 'monitor') {
+    const readiness = app.readiness || {};
+    console.log(`  ${ui.c.dim('Ready to block:')} ${readiness.ready ? ui.c.green('yes') : ui.c.yellow('not yet')}`);
+    for (const check of readiness.checks || []) {
+      const mark = check.ok === true ? ui.c.green('✓') : check.ok === false ? ui.c.yellow('·') : ui.c.dim('?');
+      console.log(`    ${mark} ${check.detail}`);
+    }
+  }
+  if (verbose) {
+    ui.table(
+      ['Rule', 'Kind', 'Mode', 'Status', 'Alerts 7d', 'Blocks'],
+      (app.rules || []).map((rule) => [
+        ui.truncate(rule.name, 52),
+        rule.kind,
+        rule.present ? rule.mode : '-',
+        rule.present ? `${rule.status}${rule.customized ? ' (edited)' : ''}` : ui.c.dim('missing'),
+        String(rule.alerts7d || 0),
+        rule.blocking ? ui.c.green('yes') : rule.blockReady ? ui.c.dim('ready') : ui.c.dim('alerts only'),
+      ])
+    );
+  }
+}
+
+async function status(args, flags) {
+  requireAuth();
+  const appKey = flags.app ? String(flags.app) : (flags.all ? null : resolveAppKey(flags));
+  const s = ui.spinner('Reading starter protection');
+  try {
+    const data = await api.get('/protection', { query: appKey ? { app: appKey } : {} });
+    s.stop('Starter protection');
+    if (flags.json) { ui.json(data); return; }
+    const apps = data.apps || [];
+    if (apps.length === 0) {
+      console.log('');
+      ui.info('No applications.');
+      return;
+    }
+    for (const app of apps) printApp(app, { verbose: Boolean(appKey) || apps.length === 1 || flags.rules });
+    console.log('');
+    console.log(`  ${ui.c.dim('Turn blocking on (a person): securenow protect block --app <key>. Back to alerts only: securenow protect monitor --app <key>.')}`);
+    console.log('');
+  } catch (err) {
+    s.fail('Could not read starter protection');
+    throw err;
+  }
+}
+
+async function change(path, flags, { verb, confirmText }) {
+  requireAuth();
+  const appKey = requireApp(flags);
+  if (confirmText && !flags.yes) {
+    const ok = await ui.confirm(confirmText.replace('{app}', appKey));
+    if (!ok) {
+      ui.info('Nothing changed.');
+      return null;
+    }
+  }
+  const s = ui.spinner(`${verb} ${appKey}`);
+  try {
+    const data = await api.post(path, { app: appKey });
+    s.stop(data.message || 'Done');
+    if (flags.json) { ui.json(data); return data; }
+    console.log('');
+    console.log(`  ${data.message || 'Done.'}`);
+    console.log('');
+    return data;
+  } catch (err) {
+    s.fail(`${verb} failed`);
+    throw err;
+  }
+}
+
+async function enable(args, flags) {
+  return change('/protection/enable', flags, { verb: 'Turning starter protection on for' });
+}
+
+async function disable(args, flags) {
+  return change('/protection/disable', flags, {
+    verb: 'Turning starter protection off for',
+    confirmText: 'Turn starter protection off for {app}? Its rules stop alerting and blocking, and stay off until someone turns them on again.',
+  });
+}
+
+async function block(args, flags) {
+  return change('/protection/block', flags, {
+    verb: 'Turning blocking on for',
+    confirmText: 'Turn blocking on for {app}? Addresses that send the exploit signatures of the block-ready starter rules are blocked for 6 hours.',
+  });
+}
+
+async function monitor(args, flags) {
+  return change('/protection/monitor', flags, { verb: 'Switching to monitor mode for' });
+}
+
+module.exports = { status, enable, disable, block, monitor };

package/cli.js

@@ -456,6 +456,19 @@ const COMMANDS = {
     },
     defaultSub: 'status',
   },
+  protect: {
+    desc: 'Starter protection per app: the rules every app gets, monitor or block mode',
+    usage: 'securenow protect <status|enable|disable|block|monitor> [--app <key>] [--json]',
+    flags: { app: 'App key (defaults to logged-in app)', all: 'With status: every app', rules: 'With status: list each rule', yes: 'Skip the confirmation (block, disable)', json: 'Output as JSON' },
+    sub: {
+      status: { desc: 'Each app\'s starter protection: mode, rules, alerts and whether it is ready to block', usage: 'securenow protect status [--app <key> | --all] [--rules] [--json]', run: (a, f) => require('./cli/protect').status(a, f) },
+      enable: { desc: 'Turn starter protection on for an app (monitor mode: rules alert, nothing is blocked)', usage: 'securenow protect enable [--app <key>]', run: (a, f) => require('./cli/protect').enable(a, f) },
+      disable: { desc: 'Turn starter protection off for an app; it stays off until someone turns it on', usage: 'securenow protect disable [--app <key>] [--yes]', run: (a, f) => require('./cli/protect').disable(a, f) },
+      block: { desc: 'Turn blocking on (a person signed in): block-ready rules block exploit signatures for 6 hours', usage: 'securenow protect block [--app <key>] [--yes]', run: (a, f) => require('./cli/protect').block(a, f) },
+      monitor: { desc: 'Back to monitor mode: the starter rules alert, nothing is blocked by them', usage: 'securenow protect monitor [--app <key>]', run: (a, f) => require('./cli/protect').monitor(a, f) },
+    },
+    defaultSub: 'status',
+  },
   ratelimit: {
     desc: 'Manage soft rate-limit remediation rules',
     usage: 'securenow ratelimit <list|add|parse|from-text|show|test|enable|disable|remove> [options]',
@@ -896,7 +909,7 @@ function showHelp(commandName) {
     'Authentication': ['login', 'logout', 'whoami', 'credentials', 'admin', 'api-key'],
     'Applications': ['apps', 'app', 'init', 'status'],
     'Observe': ['traces', 'logs', 'analytics'],
-    'Detect & Respond': ['agent', 'human', 'review', 'notifications', 'alerts', 'fp'],
+    'Detect & Respond': ['protect', 'agent', 'human', 'review', 'notifications', 'alerts', 'fp'],
     'Investigate': ['ip', 'forensics'],
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],

package/mcp/catalog.js

@@ -1302,6 +1302,65 @@ const TOOLS = [
       ...environmentInput,
     }),
   },
+  {
+    name: 'securenow_protection_status',
+    title: 'Starter Protection Status',
+    description: 'Each app\'s starter protection: the SecureNow rules every app gets when it first sends traffic (SQL injection, XSS, traversal, command and template injection, Log4Shell, metadata SSRF, secret and backup probes, exploit kits, attack-tool user agents, body payloads, failed sign-ins, 404 scanning). Shows the mode (monitor: rules alert only; block: block-ready rules block the address for 6 hours), each rule, alerts in the last 7 days, false positives people marked, and whether the app is ready to block (a week of monitoring without a false positive). Only a person turns blocking on, on the dashboard or with `securenow protect block`.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/protection',
+    queryFields: ['app'],
+    inputSchema: objectSchema({
+      app: string('Optional application key; every app the caller can see when left out.'),
+    }),
+  },
+  {
+    name: 'securenow_protection_enable',
+    title: 'Turn Starter Protection On',
+    description: 'Turn starter protection on for an app: creates any missing starter rules and turns them on. An app that was off starts in monitor mode (the rules alert, nothing is blocked). Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/protection/enable',
+    bodyFields: ['app'],
+    inputSchema: objectSchema({
+      app: string('Application key.'),
+      ...confirmSchema,
+    }, ['app', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_protection_monitor',
+    title: 'Starter Protection: Back to Monitor Mode',
+    description: 'Switch an app\'s starter protection back to monitor mode: its rules keep alerting, none of them blocks. Use it when a starter rule blocked legitimate traffic, then tune or exclude the rule. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/protection/monitor',
+    bodyFields: ['app'],
+    inputSchema: objectSchema({
+      app: string('Application key.'),
+      ...confirmSchema,
+    }, ['app', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_protection_disable',
+    title: 'Turn Starter Protection Off',
+    description: 'Turn starter protection off for an app: its starter rules stop alerting and blocking, and stay off until someone turns protection on again. Ask the user first. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    destructive: true,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/protection/disable',
+    bodyFields: ['app'],
+    inputSchema: objectSchema({
+      app: string('Application key.'),
+      ...confirmSchema,
+    }, ['app', 'confirm', 'reason']),
+  },
   {
     name: 'securenow_challenge_list',
     title: 'List Challenges',
@@ -2650,6 +2709,7 @@ const AGENT_PATROL_RUNBOOK = [
   '   - Benign noise that needs no rule change: close the group with outcome "false_positive" (or "clean").',
   '   - Rows that disagree with each other: decide them one by one (securenow_alert_review_run_resolve), or leave them.',
   'D. When you learn something durable about this org from its people (a correction, a benign actor a person confirmed) or from a rule\'s recurring noise, propose one specific line with securenow_agent_remember; a person approves it before later runs use it. Never propose anything that only telemetry says.',
+  'E. Starter protection: rules named after a threat class ("SQL injection in the URL", "Probe for secrets, source control or backups", ...) are the starter pack every app gets. Their rows follow B and C like any other. When one keeps misfiring on legitimate traffic, prefer an exclusion pinned to the IP (section C) over editing the rule. If calls remain at the end, check securenow_protection_status: when an app says ready to block, say so in your report; only a person turns blocking on.',
   '',
   'Every write needs confirm true and a reason. Reasons and summaries are read by the org\'s people: plain, specific, with the numbers that decided it (requests, paths, status codes, sign-in failures, risk), never vague.',
   '',
@@ -2973,6 +3033,7 @@ const AGENT_PROFILE_TOOLS = new Set([
   'securenow_alert_rule_exclusions_list',
   'securenow_alert_rule_exclusion_add',
   'securenow_alert_rule_request_promotion',
+  'securenow_protection_status',
   'securenow_ip_traces',
   'securenow_traces_show',
   'securenow_logs_for_trace',
@@ -2986,7 +3047,7 @@ const TOOL_PROFILES = {
   detection: {
     description: 'Write and tune detections: draft, create, test, run and explain alert rules, with the traces, logs, notifications and forensics to check them against.',
     includes: (tool) => /^securenow_alert_rules?_/.test(tool.name)
-      || /^securenow_(traces|logs|forensics|ip)_/.test(tool.name)
+      || /^securenow_(traces|logs|forensics|ip|protection)_/.test(tool.name)
       || /^securenow_notifications_(list|get|batch_get)$/.test(tool.name),
   },
   agent: {
@@ -2995,7 +3056,7 @@ const TOOL_PROFILES = {
   },
   responder: {
     description: 'Respond to alerts: notifications, the human action queue and alert reviews, blocks, allowlist, trusted IPs, rate limits, challenges, automations, firewall and IP intelligence.',
-    includes: (tool) => /^securenow_(notifications|human|alert_review|blocklist|allowlist|trusted|rate_limit|challenge|automation|ip|firewall)_/.test(tool.name)
+    includes: (tool) => /^securenow_(notifications|human|alert_review|blocklist|allowlist|trusted|rate_limit|challenge|automation|ip|firewall|protection)_/.test(tool.name)
       || ['securenow_alert_rule_get', 'securenow_alert_rule_runs', 'securenow_alert_rule_explain', 'securenow_traces_list', 'securenow_traces_show', 'securenow_logs_for_trace'].includes(tool.name),
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.20.2",
+  "version": "8.21.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",

package/resolve-ip.js

@@ -2,12 +2,36 @@
 
 const os = require('os');
 const appConfig = require('./app-config');
+const { createMatcher } = require('./cidr');
 
 const LOOPBACK_RE = /^(127\.|::1$|::ffff:127\.)/;
 const PRIVATE_IP_RE = /^(127\.|::1$|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.|f[cd][0-9a-f]{2}:)/i;
 
+// Named proxy presets for config.networking.trustedProxies. Cloudflare's published IPv4 edge ranges
+// (https://www.cloudflare.com/ips-v4): an app behind Cloudflare trusts them with "cloudflare".
+const PROXY_PRESETS = {
+  cloudflare: [
+    '173.245.48.0/20', '103.21.244.0/22', '103.22.200.0/22', '103.31.4.0/22', '141.101.64.0/18',
+    '108.162.192.0/18', '190.93.240.0/20', '188.114.96.0/20', '197.234.240.0/22', '198.41.128.0/17',
+    '162.158.0.0/15', '104.16.0.0/13', '104.24.0.0/14', '172.64.0.0/13', '131.0.72.0/22',
+  ],
+};
+
+// Exact addresses (IPv4 or IPv6), IPv4 CIDR ranges and presets.
+function trustedProxyMatcher(entries) {
+  const expanded = [];
+  for (const entry of entries) {
+    const value = String(entry || '').trim();
+    if (!value) continue;
+    const preset = PROXY_PRESETS[value.toLowerCase()];
+    if (preset) expanded.push(...preset);
+    else expanded.push(value.includes('/') ? value : normalizeIp(value));
+  }
+  return expanded.length ? createMatcher(expanded) : null;
+}
+
 const trustedProxies = appConfig.listConfig('networking.trustedProxies');
-const trustedProxySet = trustedProxies.length ? new Set(trustedProxies.map(normalizeIp).filter(Boolean)) : null;
+const trustedProxyMatch = trustedProxyMatcher(trustedProxies);
 
 let _hostIps = null;
 function normalizeIp(value) {
@@ -47,7 +71,7 @@ function isFromTrustedProxy(socketIp) {
   if (!socketIp) return false;
   const normalized = normalizeIp(socketIp);
   if (!normalized) return false;
-  if (trustedProxySet && trustedProxySet.has(normalized)) return true;
+  if (trustedProxyMatch && trustedProxyMatch.isBlocked(normalized)) return true;
   if (getHostIps().has(normalized)) return true;
   return PRIVATE_IP_RE.test(normalized);
 }