Quickstart

1. Build xorappsec.
2. Run xorappsec demo.
3. Open the shop on :8080 and the dashboard on :9090.
4. Run ./examples/smoke.sh.

Expected smoke result: login and catalog return 200; SQLi, XSS, Log4Shell (including obfuscated lookups), Spring4Shell, Text4Shell, and open redirect return 403.

Protect an existing app

xorappsec all --upstream http://127.0.0.1:3000 --listen 0.0.0.0:8080

Point clients at xorappsec, not at the origin. Put TLS either on xorappsec or on a terminator listed in trusted-proxies.

First policy change

Edit config/local_policy.yaml. The orchestrator reloads on mtime, or send SIGHUP, or:

xorappsec ctl apply-policy --policy config/local_policy.yaml