{
  "version": "0.9.0-beta.61",
  "manifest": {
    "name": "hardening",
    "version": "0.9.0-beta.61",
    "tier": "core",
    "voidbase": "*",
    "provides": [
      "hardening@1"
    ],
    "config": {
      "cors_origins": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_CORS_ORIGINS",
        "description": "The origins a browser may call the API from, comma separated. Empty allows any."
      },
      "referrer_policy": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_REFERRER_POLICY",
        "description": "The Referrer-Policy header, when it names one."
      },
      "permissions_policy": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_PERMISSIONS_POLICY",
        "description": "The Permissions-Policy header, when it names one."
      },
      "hsts": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_HSTS",
        "description": "Strict-Transport-Security: 1 for one year, or the header's own value."
      },
      "csp": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_CSP",
        "description": "The Content-Security-Policy for everything no route or file policy covers."
      },
      "csp_files": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_CSP_FILES",
        "description": "The Content-Security-Policy on served files. Empty keeps the built-in one."
      },
      "csp_routes": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_CSP_ROUTES",
        "description": "<path glob>:<policy> entries separated by ;, the first match deciding."
      },
      "csrf": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_CSRF",
        "description": "double-submit requires the X-CSRF-Token header on a cookie request."
      },
      "cross_origin": {
        "type": "string",
        "applies": "runtime",
        "default": "",
        "knob": "VOIDBASE_CROSS_ORIGIN",
        "description": "1 sends Cross-Origin-Embedder-Policy require-corp and Cross-Origin-Resource-Policy same-origin."
      }
    }
  },
  "files": [
    {
      "path": "manifest.json",
      "bytes": 2216
    },
    {
      "path": "main.js",
      "bytes": 2314
    }
  ],
  "source": {
    "repository": "voidbase-cloud/voidbase",
    "commit": "4509c5a41b020abc59e06dcd0b535b00ad6be614",
    "directory": "packages/plugin-hardening"
  },
  "publishedOn": "2026-09-13",
  "audit": {
    "ranOn": "2026-09-13T19:55:08.733Z",
    "checks": [
      {
        "name": "public repository",
        "passed": true,
        "detail": "reachable without signing in"
      },
      {
        "name": "not archived",
        "passed": true,
        "detail": "actively owned"
      },
      {
        "name": "has a licence",
        "passed": false,
        "detail": "GitHub cannot identify one"
      },
      {
        "name": "has a commit to record",
        "passed": true,
        "detail": "4509c5a41b02 (v0.9.0-beta.61)"
      },
      {
        "name": "the plugin's directory exists",
        "passed": true,
        "detail": "packages/plugin-hardening at 4509c5a41b02"
      },
      {
        "name": "has a manifest.json",
        "passed": true,
        "detail": "present"
      },
      {
        "name": "the manifest is valid",
        "passed": true,
        "detail": "hardening 0.9.0-beta.61, tier core, voidbase *"
      },
      {
        "name": "names the interfaces it provides and needs",
        "passed": true,
        "detail": "hardening@1"
      },
      {
        "name": "has something an instance loads",
        "passed": true,
        "detail": "1 module(s), 0 hook or migration file(s)"
      },
      {
        "name": "nothing to compile",
        "passed": true,
        "detail": "plain JavaScript and JSON"
      },
      {
        "name": "imports only what an instance provides, and nothing outside itself",
        "passed": true,
        "detail": "@voidbase-cloud/voidbase/hardening-middleware, @voidbase-cloud/voidbase/kernel"
      },
      {
        "name": "is small enough to read",
        "passed": true,
        "detail": "4530 bytes in 2 file(s)"
      },
      {
        "name": "nothing obviously alarming in what it loads",
        "passed": true,
        "detail": "read 2 file(s)"
      },
      {
        "name": "has a README",
        "passed": true,
        "detail": "present"
      }
    ]
  }
}