@apitraffic/meteor
Advanced tools
Meteor integration for ApiTraffic: request capture and the ApiTraffic firewall, with APM through @apitraffic/apm, on Meteor's WebApp.
@apitraffic/meteor is ApiTraffic for Meteor, mounted on Meteor's WebApp. Call mount() once from your server's main module and every HTTP request your Meteor server serves is recorded - request and response, headers, bodies, timing, the route your handlers matched, and the outbound HTTP calls made while serving it - and checked by the ApiTraffic firewall: your REST endpoints in WebApp.handlers, the handlers packages add, static assets, and the app's page itself.
It is @apitraffic/node, the one-install SDK, wired into Meteor. It contains no capture, firewall or instrumentation logic of its own: Meteor 3's WebApp is an Express application, so requests are recorded by @apitraffic/express and checked by @apitraffic/waf, exactly as in a plain Express application. What actually runs - the firewall, redaction, exclusions, span capture - is switched on from your ApiTraffic account, not in code.
On Meteor, use this package. It is @apitraffic/node placed where Meteor needs it: capture and the firewall at the very head of WebApp.rawHandlers, ahead of everything else Meteor does with a request, plus a firewall() you can mount after your own body parser. Mounting @apitraffic/express on WebApp.handlers yourself records only what reaches your handlers.
For other frameworks, see the "Which package should I install?" table in the @apitraffic/node README.
WebApp is built on Express 4, and 3.1 and later, on Express 5. Meteor 2 runs on Node 14, which ApiTraffic does not support, and its Connect-based WebApp is not mounted on.webapp package (present in every Meteor app that serves HTTP). mount() runs on the server only.ingest.apitraffic.io (telemetry) and api.apitraffic.io (settings and live configuration). Live configuration changes (redaction rules, exclusions, firewall policy) are pushed over a realtime connection to Ably, so also allow its realtime hosts; if that connection is blocked, live updates wait for a restart and nothing else is affected.meteor npm install @apitraffic/meteor
or, with the npm of your own Node installation:
npm install @apitraffic/meteor
@apitraffic/node comes with it as a dependency. The examples below that parse bodies use Express's body parser, from express in your own dependencies (meteor npm install express): the copy Meteor's webapp package bundles is not one your code can import.
Set your credentials in the environment:
export API_TRAFFIC_TOKEN=your-ingest-token
export API_TRAFFIC_BUCKET=your-bucket-id
Call mount() once, on the server, as early in your main module as you can:
// server/main.js
import { mount } from '@apitraffic/meteor';
// Token and bucket come from API_TRAFFIC_TOKEN and API_TRAFFIC_BUCKET.
mount();
mount(options?, webApp?) finds the running server's WebApp itself (Package.webapp.WebApp). To be explicit, pass the one from meteor/webapp:
import { WebApp } from 'meteor/webapp';
import { mount } from '@apitraffic/meteor';
mount({ token: process.env.API_TRAFFIC_TOKEN, bucket: process.env.API_TRAFFIC_BUCKET }, WebApp);
It mounts once per WebApp, however many times it is called, and returns whether that call mounted (false on the client, without a Meteor 3 WebApp, or when the WebApp already has ApiTraffic). Settings from Meteor.settings work as any other options do:
import { Meteor } from 'meteor/meteor';
import { mount } from '@apitraffic/meteor';
mount(Meteor.settings.apiTraffic);
WebApp runs rawHandlers ahead of everything else it does - compression, the ROOT_URL_PATH_PREFIX check, static files, Meteor's internal handlers, the handlers packages and your application add to WebApp.handlers, and the app's page.
WebApp.rawHandlers, ahead of raw handlers packages added before your code ran (on Express 4, behind Express's own query and expressInit layers, so req.ip, req.protocol and req.query are what your code sees).firewall(), mounted by you after a body parser, runs the same firewall again once the body is parsed. Meteor parses no request bodies itself, so the firewall at the head of rawHandlers sees none:import express from 'express';
import { WebApp } from 'meteor/webapp';
import { firewall } from '@apitraffic/meteor';
WebApp.handlers.use(express.json(), firewall());
express is not a Meteor dependency by default: add it with meteor npm install express. express.json() consumes JSON bodies for every later handler, so if one needs the raw body (a webhook that verifies a signature over it, say), mount the pair on your API path only, for example WebApp.handlers.use('/api', express.json(), firewall()).
Call mount() before your other server code adds handlers: the earlier it runs, the less of Meteor's startup it misses.
Options are passed to mount(), or set as environment variables. You can mix the two.
Precedence: an option passed in code wins over its environment variable, which wins over the built-in default. With every option in the environment, mount() with no arguments is a complete setup. On top of that, settings from your ApiTraffic account - redaction rules, exclusions, the firewall policy, APM capture switches - are loaded at startup and pushed to every connected server in real time, without a restart or a deploy.
A few settings combine differently:
| Setting | Rule |
|---|---|
| Firewall on or off | Off if either waf: false is passed or API_TRAFFIC_WAF_ENABLED is exactly false or 0, or off in any case. This variable does not use the switch parser below: FALSE, no or a value with spaces leaves the firewall on. Neither can turn on a firewall your account has not enabled. |
waf.offlineWafMode | API_TRAFFIC_OFFLINE_WAF_MODE wins over the code option, so you can change it during an incident without a deploy. Only exactly closed (lowercase) means closed: any other non-empty value, such as CLOSED, still overrides the option and fails open. |
captureStatementParams, captureRedisKeys | On if your code or environment turns it on, or the bucket's APM Capture settings do. |
captureCallSite | The bucket's APM Capture setting applies unless you set it in code or the environment. Set locally it can only turn code location on for the SDK's own spans: a local false does not override a bucket that has it on. The APM bridge reads API_TRAFFIC_CAPTURE_CALL_SITE (or its own captureCallSite option) itself, so a false there does turn it off for OpenTelemetry spans. |
captureStackDepth | The bucket's APM Capture setting applies unless you set it in code or the environment, which then wins. |
interceptOutbound | A blank value ("", null, an empty variable) turns outbound capture off. For the other switches, limits, sample rates, token, bucket and accountSid, a blank value counts as not set (apiHost and ingestHost fall back only when empty; a value of spaces is used as given). Two exceptions: passing debug at all, even as undefined, overrides API_TRAFFIC_DEBUG, and a blank projectRoot in code skips API_TRAFFIC_PROJECT_ROOT. |
Switches and numeric limits also accept strings (true/false, yes/no, on/off, 1/0; whole numbers for byte caps), so { captureSpans: process.env.CAPTURE_SPANS } works. An invalid value is reported once on the console and ignored. debug and strict are not parsed from strings in code - pass true or false, which matters for values from Meteor.settings - and API_TRAFFIC_DEBUG turns debug on only when it is exactly true (any case).
| Option | Environment variable | Type | Default | Details |
|---|---|---|---|---|
token | API_TRAFFIC_TOKEN | string | - | Required. Ingest token from your ApiTraffic account. |
bucket | API_TRAFFIC_BUCKET | string | - | Required. ID of the bucket captured traffic is sent to. |
waf | API_TRAFFIC_WAF_ENABLED | false or object | unset | Local override for the firewall. false refuses it whatever the dashboard says; an object passes settings to @apitraffic/waf (and enabled: false in it turns the firewall off too). Normally left unset. |
debug | API_TRAFFIC_DEBUG | boolean | false | Log SDK activity to the console. |
strict | - | boolean | false | Makes the base client's setup() throw on misconfiguration (missing token or bucket) instead of logging. This package runs setup in the background and catches that error, so strict does not stop your app from booting, and the missing-token message is then printed only when API_TRAFFIC_DEBUG is set. Leave it off. |
accountSid | API_TRAFFIC_ACCOUNT_SID | string | learned from settings | Only needed by a process that mints embed tokens without serving requests. |
apiHost | API_TRAFFIC_API_HOST | string | api.apitraffic.io | Settings and configuration host. |
ingestHost | API_TRAFFIC_INGEST_HOST | string | ingest.apitraffic.io | Host captured traffic is sent to. |
interceptOutbound | API_TRAFFIC_INTERCEPT_OUTBOUND | switch | true | Capture outbound http, https and fetch calls. |
captureFetch | API_TRAFFIC_CAPTURE_FETCH | switch | true | Capture outbound global fetch (needs interceptOutbound). |
redactSensitiveKeys | API_TRAFFIC_REDACT_SENSITIVE_KEYS | switch | true | Mask credential-shaped body keys and query parameters. |
maxBodyBytes | API_TRAFFIC_MAX_BODY_BYTES | bytes | 524288 (512 KB) | Largest request or response body sent; a larger one is cut to the cap and ends with …[truncated by ApiTraffic: N bytes total]. |
maxRedactBodyBytes | API_TRAFFIC_MAX_REDACT_BODY_BYTES | bytes | 1048576 (1 MB) | Largest body the SDK redacts; a larger one becomes a placeholder first. |
maxFetchBodyLength | API_TRAFFIC_MAX_FETCH_BODY_LENGTH | bytes | 524288 (512 KB) | Largest outbound body captured. |
requestSampleRate | API_TRAFFIC_REQUEST_SAMPLE_RATE | 0–1 | 1 | Fraction of requests sent. 5xx responses are always sent. |
ingestBatch | API_TRAFFIC_INGEST_BATCH | switch | true | Batch payloads when your account and the ingest host support it. |
ingestGzip | API_TRAFFIC_INGEST_GZIP | switch | true | Compress those batches when your account asks for it. |
captureSpans | API_TRAFFIC_CAPTURE_SPANS | switch | true | Master switch for spans and per-request span rollups. |
captureStatements | API_TRAFFIC_CAPTURE_STATEMENTS | switch | true | Include normalized SQL/command text in spans. |
captureStatementParams | API_TRAFFIC_CAPTURE_STATEMENT_PARAMS | switch | false | Also keep statements as issued, with bind values (your users' data). |
captureRedisKeys | API_TRAFFIC_CAPTURE_REDIS_KEYS | switch | false | Include the concrete Redis key, unmasked. |
captureCallSite | API_TRAFFIC_CAPTURE_CALL_SITE | switch | true (bucket setting) | Record the application code location that started each span. |
captureStackDepth | API_TRAFFIC_CAPTURE_STACK_DEPTH | whole number ≥ 0 | 10 (bucket setting) | Application frames kept per span. |
projectRoot | API_TRAFFIC_PROJECT_ROOT | string | detected | Directory code locations are reported relative to. Set it if code locations come out wrong in a meteor build bundle. |
redisKeyPatterns | - | array of strings or RegExps | [] | Redis key patterns the automatic masking cannot infer. |
maxSpansPerRequest | API_TRAFFIC_MAX_SPANS_PER_REQUEST | count | 500 | Spans kept per request. |
spanSampleRate | API_TRAFFIC_SPAN_SAMPLE_RATE | 0–1 | 1 | Fraction of requests that keep full span detail. |
maxSpanMetaBytes | API_TRAFFIC_MAX_SPAN_META_BYTES | bytes | 2048 | Size cap on each span's metadata, after redaction. |
Delivery to ApiTraffic honours HTTPS_PROXY, HTTP_PROXY, ALL_PROXY and NO_PROXY. The configuration reference covers the long tail: firewall options, the APM preload's own options, offline definitions and server labels.
Every HTTP request WebApp serves, including the ones your code never sees, with its final status and whatever your code tagged on the way:
WebApp.handlers, with the route they matched,public/,405 for a method other than GET or HEAD on it,The route your WebApp.handlers matched is sent with each request, mounted routers and ROOT_URL_PATH_PREFIX included, so router.get('/items/:itemId') mounted at /api/v1 is the endpoint /api/v1/items/{itemId}. See Endpoint handling.
res.send() or res.json(), before Meteor's compression: a body written with res.write() / res.end(body) to a client that accepts compression reaches capture as compressed chunks and is not recorded, as with compression in any Express application. Bodies over maxBodyBytes (512 KB) are cut to that size and marked as truncated, and bodies over maxRedactBodyBytes (1 MB) are replaced by a placeholder.http, https and global fetch while serving a request, linked to it. See Outbound requests.requestSampleRate sends a fraction of requests; server errors are always sent.DDP - Meteor methods and publications - travels over Meteor's WebSocket, not through WebApp, and is not recorded as requests. Static assets and the app's page are recorded like any other request; to leave them out, add exclusions in your ApiTraffic account.
The client address recorded with each request, and used by the firewall's IP rules and rate limits, is Express's req.ip. Meteor's HTTP_FORWARDED_COUNT does not set it: tell Express how many proxies to trust, the same number, or every request is recorded as coming from your load balancer:
import { WebApp } from 'meteor/webapp';
WebApp.expressApp.set('trust proxy', 1);
Nothing here needs a code change: it is configured in your ApiTraffic account and pushed to every connected server.
redactSensitiveKeys (on by default), credential-shaped body keys and query parameters (password, token, secret, api_key and similar) are masked too.The ApiTraffic firewall is mounted by mount(), and whether it runs is decided in your ApiTraffic account: nothing is loaded until a policy is live, and a policy change reaches every server without a deploy. It runs right after capture, at the head of WebApp.rawHandlers, so a request it blocks never reaches a package, a static file or your code. Blocked requests are still recorded, with the policy's status and waf.* tags.
Meteor parses no request bodies, so there the firewall sees none. If your endpoints parse bodies, mount firewall() again after your body parser, as in Where it mounts. A request is evaluated there only when it has a body the first evaluation did not see, and is never counted against rate limits twice. firewall() runs the firewall of the WebApp it is mounted in; before mount(), and under waf: false, it just calls next().
To refuse the firewall locally whatever the dashboard says, pass waf: false or set API_TRAFFIC_WAF_ENABLED=false:
mount({ waf: false });
Use the option when your change process requires that anything able to reject production traffic ships through a deploy; use the variable as an incident kill switch, which works even when ApiTraffic is unreachable. See Firewall setup.
The APM bridge records database (MongoDB included), cache, queue, GraphQL, gRPC and fetch/undici spans inside each request. OpenTelemetry instruments libraries by patching them as they are loaded, so it has to start before Meteor does: Meteor loads its packages, MongoDB's driver among them, before your main module runs, so calling register() from your own code is too late for them. So it needs a preload, into the server bundle meteor build produces.
Install @apitraffic/apm, which brings the OpenTelemetry packages it needs:
meteor npm install @apitraffic/apm
Then preload the bridge, from the bundle directory, where your npm dependencies live under programs/server/npm/node_modules:
cd bundle
node -r ./programs/server/npm/node_modules/@apitraffic/meteor/dist/register.js main.js
Where you cannot change the command (Galaxy, a container's entrypoint), set NODE_OPTIONS="-r ./programs/server/npm/node_modules/@apitraffic/meteor/dist/register.js" with the bundle directory as the working directory.
@apitraffic/meteor/register is @apitraffic/node/register, re-exported so it resolves from an application that installs only this package. It reads its configuration from the API_TRAFFIC_* environment variables and never throws: if the OpenTelemetry packages are missing or fail to start, APM is skipped with a one-line reason and your server starts normally.
The preload is for applications with no other tracing. If yours already configures OpenTelemetry, skip it and add ApiTrafficSpanProcessor from @apitraffic/apm to your own provider; with Datadog or New Relic loaded the preload steps aside on its own. See Set up APM.
The helpers work anywhere a request is being handled: your handlers in WebApp.handlers, raw handlers, and any code they call. Outside a request (a Meteor method, a Meteor.startup callback, a cron job) they do nothing, and they never throw.
tag(key: string, value: string) makes a request searchable, for example by account or user ID:
import { WebApp } from 'meteor/webapp';
import { tag } from '@apitraffic/meteor';
WebApp.handlers.get('/api/orders/:id', async (req, res) => {
tag('accountId', req.get('x-account-id') ?? 'none');
res.json({ id: req.params.id });
});
Keys are 1–64 characters (a letter first, then letters, digits, _, . or -); the prefixes redaction., apitraffic. and at. are reserved and dropped, and waf. is the firewall's own namespace (such a key is stored among the firewall's tags), so do not use it. Values are cut to 255 characters, and a request holds at most 32 tag keys. A tag that breaks a rule (or a missing value) is dropped, never thrown. See Tags.
trace(content: string) is console.log for production: a timestamped note on the request (up to 255 characters, 250 per request; a longer message is dropped, not cut).
import { trace } from '@apitraffic/meteor';
trace('cart total exceeded the free-shipping threshold');
span(type, name, fn, meta?) runs fn, times it and records it on the request's waterfall, returning what fn returns; time() is the same function. startSpan(type, name, meta?) returns a handle to end() for work that does not fit one function, and addSpan() records a span you built yourself.
import express from 'express';
import { WebApp } from 'meteor/webapp';
import { span, trace } from '@apitraffic/meteor';
import { Orders } from '/imports/api/orders';
WebApp.handlers.use(express.json());
WebApp.handlers.get('/api/orders/:id', async (req, res) => {
trace(`Loading order ${req.params.id}`);
const order = await span('db.query', 'load order', () => Orders.findOneAsync(req.params.id));
res.json(order);
});
type is one of db.query, redis, cache, http.out, queue, rpc, graphql or custom. getContext() and getRequestManager() expose the current request's context for advanced use; most applications never need them. See Per-request APIs.
The embeddable request log (and embedded reports and dashboards) authenticate with a short-lived JWT that locks in the bucket, the filters and the request detail tabs the embed may show. It is minted on your server with an Administrator API token with no access scopes, set as API_TRAFFIC_EMBED_TOKEN (the ingest token the SDK reports with cannot mint embed tokens), and this package mints it:
import { WebApp } from 'meteor/webapp';
import { embedToken } from '@apitraffic/meteor';
// An embed token is a read credential. Meteor's HTTP handlers carry no user,
// so userFromRequest() is your own lookup (a session cookie or bearer token).
WebApp.handlers.get('/embed/token', async (req, res, next) => {
try {
const user = await userFromRequest(req);
if (!user) return res.status(401).end();
const { token, expiresAt } = await embedToken({
// Structured: the id is escaped, so a value such as `x" OR method == "GET`
// cannot add a condition of its own.
filters: { tags: { customerId: String(user._id) } },
ttl: 900,
});
res.json({ token, expiresAt });
} catch (err) {
next(err); // Express 4 (Meteor 3.0) does not catch a rejected async handler; on Express 5 this is harmless
}
});
The host, bucket and account come from the SDK you already configured and the token from API_TRAFFIC_EMBED_TOKEN, so a call names only what is specific to this embed. Everything is optional, except reportSid or dashboardSid for a report or dashboard embed:
| Option | Default | Details |
|---|---|---|
bucketSid | The bucket the SDK reports to (request log only) | The bucket the embed is scoped to. A report or dashboard keeps its own scope unless you pass one. |
view | 'request-log' | 'request-log', 'report' (with reportSid) or 'dashboard' (with dashboardSid). |
filters | {} | environmentSid, criteria, streamViewSid, tags (request log) or filter, environmentSid, tags (report and dashboard) - signed into the token, so the browser cannot widen them. tags ({ customerId: id }) is written into the criteria (for a report or dashboard, the filter) safely; if you build criteria yourself, put values in double quotes through escapeCriteriaValue(). |
timeRange / timeRanges | The report's own / all | Report and dashboard embeds: the range the embed opens with ({ relative: 'last_7d' }) and the ranges the viewer may pick. |
ttl | 3600 | Token lifetime in seconds (60–86400). |
theme | 'light' | 'light', 'dark' or 'auto'. |
tabs | The API's default set | Request detail tabs this embed may show. Request log only: the API refuses it for a report or dashboard. |
features | {} | copyRequest, includeBodies. Request log only: the API refuses it for a report or dashboard. |
accountSid | From your SDK settings | Only needed in a process that does not serve requests through ApiTraffic. Also read from API_TRAFFIC_ACCOUNT_SID. |
token / apiHost | API_TRAFFIC_EMBED_TOKEN / the SDK's host | Override the credential or host for one call. |
Data behind a tab you do not grant is never returned to the browser - the tabs are an access boundary, not a display setting.
This is the one call in the package that rejects rather than going quiet. A token has a single useful outcome, and it is produced inside your own await, where a failure is a 500 on that route instead of a broken embed with nothing to explain it.
API_TRAFFIC_EMBED_TOKEN is a read credential. An Administrator API token can mint embed tokens for any bucket in its account, with any filters or none, so whoever holds it can read all of the account's captured traffic. Keep it in a secret store (never in client-side code, images or a repository - and never in the public part of Meteor.settings), set it only on servers that mint embed tokens, and rotate it immediately if it may have been exposed.
The SDK installs no signal handlers of its own, and Meteor has no shutdown hook to follow. To deliver what was captured before the process exits (a redeploy sends SIGTERM), call shutdown() from your own handler:
// server/main.js
import { shutdown } from '@apitraffic/meteor';
process.once('SIGTERM', async () => {
await shutdown({ flushTimeoutMs: 2000 }); // deliver what was captured, then release everything
process.exit(0);
});
shutdown({ flushTimeoutMs }) stops capturing, delivers what is in flight and queued (waiting at most flushTimeoutMs, default 2 s; whatever is left is dropped and counted), closes the realtime connection, stops background timers and removes the http/https/fetch hooks.
flush({ timeoutMs }) delivers what has been captured without stopping (default timeout 2 s). Anything not delivered in time stays queued.stats() returns delivery counters (pending, queued, delivered, recovered, dropped, breakerOpen, …), for a health endpoint or your own monitoring.All three never throw.
The package ships its own declarations. The options are typed: ApiTrafficOptions lists every option the SDK accepts; a value of the wrong type is a compile error, and so is a misspelled key in an object literal (unlisted keys are still passed through at runtime).
import { mount, type ApiTrafficOptions } from '@apitraffic/meteor';
const options: ApiTrafficOptions = { debug: process.env.NODE_ENV !== 'production' };
mount(options);
Exported types: ApiTrafficOptions, ApiTrafficExpressHandler (what firewall() returns), MeteorWebApp (the part of WebApp mount() uses, typed structurally so the declarations need no Meteor types), WafConfigureOptions, ApmOptions, RegisterResult, SpanHandle, SpanMeta, EmbedTokenOptions and EmbedTokenResult.
The SDK is built so that it can never be the reason your application fails.
mount() never throws. Without a Meteor 3 WebApp to mount on it returns false and your server starts unrecorded.tag() and trace() never throw into your handlers, and every helper does nothing outside a request.Want the app to refuse to boot without credentials? Check API_TRAFFIC_TOKEN and API_TRAFFIC_BUCKET yourself before you start the server. strict: true does not do it here: setup runs in the background and its error is caught.
Start with debug logging: set API_TRAFFIC_DEBUG=true (or pass debug: true) and restart. mount()'s own messages - such as there being no WebApp to mount on - are printed when API_TRAFFIC_DEBUG is set; check mount()'s return value too. A missing token is logged even without debug.
mount() runs on the server (in server/main.js, or a module it imports), on Meteor 3, and that API_TRAFFIC_TOKEN and API_TRAFFIC_BUCKET reach the process. The setup page in ApiTraffic shows whether the SDK has connected.WebApp.WebApp.handlers, and firewall() after it.WebApp.expressApp.set('trust proxy', n) (see Behind a proxy).res.send() or res.json(); bodies written with res.write() are compressed before capture sees them.ingest.apitraffic.io and api.apitraffic.io. Behind a proxy, set HTTPS_PROXY.@apitraffic/waf is installed alongside. Update it to the version @apitraffic/node depends on, or remove the duplicate.meteor build bundle, and @apitraffic/apm must be installed next to it. See Set up APM.More symptoms and fixes are in the troubleshooting guide.
The setup guide walks through a complete application. The ApiTraffic source (not the npm package) also includes a working Meteor 3 application in examples/basic. Its server/main.js calls mount({}, WebApp) with credentials from the environment, and mounts express.json() and firewall() ahead of its endpoints. Install Meteor first.
export API_TRAFFIC_TOKEN=your-ingest-token
export API_TRAFFIC_BUCKET=your-bucket-id
meteor npm install
meteor npm start
It listens on port 4000: try /api, /api/users/42 (a route parameter and a span), /api/outbound (an outbound call), /api/admin (a request answered with a 403) and / (the app's page and its static assets), then open the bucket's traffic stream in ApiTraffic.
@apitraffic/node - the one-install SDK this package mounts on WebApp@apitraffic/express, @apitraffic/waf, @apitraffic/apm - the packages it runsFollow @apitraffic/meteor on npm to stay updated on new releases.
Follow us on our Blog and on X.
Chat with the ApiTraffic team and other members on Discord and follow our tutorials and other videos on YouTube.
Here are some ways you can help improve ApiTraffic:
FAQs
Meteor integration for ApiTraffic: request capture and the ApiTraffic firewall, with APM through @apitraffic/apm, on Meteor's WebApp.
The npm package @apitraffic/meteor receives a total of 0 weekly downloads. As such, @apitraffic/meteor popularity was classified as not popular.
We found that @apitraffic/meteor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.
Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.
Threat Research
/Security News
Cursor removed a malicious Claude Code 2.1.313 extension from its marketplace. Socket examines registry records and the initial claims about its distribution.
