@lanonasis/security-shield

@lanonasis/security-shield

Edge-layer security for Netlify & Vercel deployments. Part of the LanOnasis Security Suite.

Docs: https://docs.lanonasis.com | Platform: https://vortexshield.lanonasis.com

LanOnasis Security Suite

Package	Layer	Purpose
@lanonasis/security-shield	Edge/CDN	Bot protection, WAF, attack mitigation
@lanonasis/security-sdk	Application	Encryption, key management, API keys

┌─────────────────────────────────────────────────────────────┐
│                        INTERNET                             │
└─────────────────────────────┬───────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  🛡️ @lanonasis/security-shield (Edge Layer)                │
│  ├─ Bot Detection & Blocking                                │
│  ├─ Honeypot Traps                                          │
│  ├─ Attack Pattern Detection (SQLi, XSS, Path Traversal)    │
│  ├─ Sensitive File Protection (.env, .git, etc.)            │
│  └─ Security Headers (HSTS, CSP, X-Frame-Options)           │
└─────────────────────────────┬───────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  🔐 @lanonasis/security-sdk (Application Layer)             │
│  ├─ AES-256-GCM Encryption                                  │
│  ├─ Key Derivation (HKDF, PBKDF2)                           │
│  ├─ API Key Generation & Hashing                            │
│  ├─ Password Hashing & Verification                         │
│  └─ Key Rotation                                            │
└─────────────────────────────┬───────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                     YOUR APPLICATION                        │
└─────────────────────────────────────────────────────────────┘

Features

• 🤖 Bot Detection - Block 50+ known malicious user agents
• 🍯 Honeypot Traps - Slow down scanners with delayed responses
• 🔒 Sensitive File Protection - Block access to .env, .git, config files
• 🛑 Attack Pattern Detection - Block SQL injection, XSS, path traversal
• 📝 Security Headers - HSTS, CSP, X-Frame-Options, and more
• 📊 Security Logging - Track all blocked requests with geo data
• ⚡ Multi-Platform - Works with both Netlify and Vercel
• 🔄 Auto-Detection - Automatically detects your deployment platform

Quick Start

Option 1: CLI (Recommended)

# Auto-detect platform (Netlify or Vercel)
npx @lanonasis/security-shield init

# Force specific platform
npx @lanonasis/security-shield init --vercel
npx @lanonasis/security-shield init --netlify

# Audit your security configuration  
npx @lanonasis/security-shield check

# Update to latest security rules
npx @lanonasis/security-shield update

Option 2: Manual - Vercel

npm install @lanonasis/security-shield

Create middleware.ts (or src/middleware.ts):

import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

// Copy from templates/vercel/middleware.ts
export function middleware(request: NextRequest) {
  // Security logic here...
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
};

Option 3: Manual - Netlify

npm install @lanonasis/security-shield

Create netlify/edge-functions/security.ts:

import { createSecurityShield } from '@lanonasis/security-shield';

export default createSecurityShield();

export const config = {
  path: '/*',
  excludedPath: ['/favicon.ico', '/_next/static/*'],
};

Configuration

Using Presets

import { createSecurityShield, standardConfig, maxSecurityConfig } from '@lanonasis/security-shield';

// Standard protection (recommended)
export default createSecurityShield(standardConfig);

// Maximum protection
export default createSecurityShield(maxSecurityConfig);

Custom Configuration

import { createSecurityShield } from '@lanonasis/security-shield';

export default createSecurityShield({
  enableHoneypot: true,
  enableUserAgentBlocking: true,
  enablePathBlocking: true,
  enableLogging: true,
  honeypotDelay: 2000,
  blockResponse: 404,
  
  // Add custom rules
  customBlockedPaths: [/^\/internal-api/i],
  customBlockedUserAgents: [/my-competitor-bot/i],
});

Using with @lanonasis/security-sdk

For full-stack security, use both packages:

// Edge function (security-shield) - runs at CDN edge
// netlify/edge-functions/security.ts
import { createSecurityShield } from '@lanonasis/security-shield';
export default createSecurityShield();

// API route (security-sdk) - runs in your application
// api/store-credentials.ts
import { getSecuritySDK } from '@lanonasis/security-sdk';

export async function POST(request: Request) {
  const security = getSecuritySDK();
  const { apiKey } = await request.json();
  
  // Encrypt sensitive data before storing
  const encrypted = security.encrypt(apiKey, `user_${userId}_stripe`);
  await db.insert('credentials', encrypted);
  
  return Response.json({ success: true });
}

What Gets Blocked

Sensitive Files

.env, .git/, config.php, wp-config.php, *.sql, *.bak, *.log

Attack Vectors

WordPress probing, phpMyAdmin, webhook scanning, shell attempts, SQL injection, XSS

Malicious Bots

Security scanners (Nikto, Nmap, sqlmap), aggressive crawlers (Bytespider, PetalBot), SEO bots (Semrush, Ahrefs)

Files Generated

File	Purpose
netlify/edge-functions/security-shield.ts	Main edge function
_headers	Security headers
netlify.toml / security-redirects.toml	Redirect rules
robots.txt	Bot blocking rules
security-shield.config.json	Your configuration

Security Logging

View logs at: https://app.netlify.com/projects/YOUR_SITE/logs/edge-functions

{
  "id": "a1b2c3d4",
  "type": "BLOCK",
  "reason": "MALICIOUS_USER_AGENT",
  "path": "/admin",
  "method": "GET",
  "userAgent": "sqlmap/1.0",
  "ip": "192.168.1.1",
  "country": "CN",
  "timestamp": "2024-01-16T12:00:00.000Z"
}

Related Packages

Package	Description
@lanonasis/security-sdk	Encryption, key management, API key generation
@lanonasis/privacy-sdk	PII detection, data masking, GDPR compliance
@lanonasis/mem-intel-sdk	Memory intelligence and context management
@lanonasis/oauth-client	OAuth client for LanOnasis services

License

MIT © LanOnasis

Built with 🔒 by the LanOnasis team