Framework-agnostic TypeScript implementation of Device Bound Session Credentials.
This is a monorepo. The published packages live under packages/.
| Package | Status |
|---|---|
@platform-sec/dbsc |
v0.1 — protocol core, in-memory store, framework-agnostic |
@platform-sec/dbsc-hono |
v0.1 — Hono adapter |
@platform-sec/dbsc-store-redis |
v0.1 — Redis-backed SessionStore (Lua CAS, cluster-safe) |
@platform-sec/dbsc-lint-rules |
v0.1 — ESLint + Opengrep rules enforcing jose.jwtVerify algorithm pinning |
Documentation: https://platformsecurity.dev/dbsc
Repository: https://github.com/platform-sec/dbsc
This repository uses pnpm workspaces.
pnpm install
pnpm lint
pnpm build
pnpm test- Threat model and security posture — what we defend against and what we don't.
- Assurance case — Claims-Arguments-Evidence: the top security claim, the assumptions it rests on, and a per-leaf mapping to source code and tests.
- Security policy — how to report a vulnerability.
A Platform Security project by AppSec Science LLC.
Technical support: support@platformsecurity.dev
Security contact: security@platformsecurity.dev
Business contact: contact@appsec.science