The OWASP Core Rule Set run by Coraza, as SPEC.md (#9) describes. The spec's third review (#9 (comment)) found that at its defaults it still refuses ordinary traffic; the spec settles that before this is built.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
The OWASP Core Rule Set run by Coraza, as `SPEC.md` (https://git.eeqj.de/sneak/smallwebwaf/pulls/9) describes. The spec's third review (https://git.eeqj.de/sneak/smallwebwaf/pulls/9#issuecomment-102835) found that at its defaults it still refuses ordinary traffic; the spec settles that before this is built.
Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in SPEC.md puts attack detection with Coraza and the Core Rule Set in the last stage, after the reputation sources. SPEC.md now settles the defaults the spec review asked about (the six changes and the default SWWAF_WAF_DISABLED_RULES in "Attack detection"), so this is built as written there. Body inspection (SWWAF_WAF_BODY_LIMIT) follows in its own issue, linked below once filed; checking the defaults against a running gitea stays with #30. One PR to next.
Coraza with the Core Rule Set 4.25.0, through the widely used Go module that embeds it, both pinned and recorded in ~/.claude/GO_PACKAGE_DEFAULTS.md; go.mod and go.sum through make tidy.
The method, the URL with its query and the headers of every request inspected where "Data flow for one request" puts it; no body, no response.
The six changes to the Core Rule Set exactly as "Attack detection" gives them, none undoable by a setting.
A match at or over the threshold refused with 403 in block, logged and alerted (waf_block) in detect; no ban for it, but the refusal counts toward the error burst of #115 and is an offence in the history.
The request log's waf_rule_ids and waf_score; metrics as "Metrics endpoint" gives them; README.md documents it all, the six changes included.
Definition of done: tests show sample attacks in the query, path and headers refused in block and only logged in detect, each of the six changes letting its ordinary gitea request through (the examples in SPEC.md), the disabled and exempt settings, off, and the log fields, alert and metrics; each test failing with its rule broken; make check and make example-app green; one PR to next, passed by a reviewer who did not write it.
Model: opus-5-5
Plan. The build order in `SPEC.md` puts attack detection with Coraza and the Core Rule Set in the last stage, after the reputation sources. `SPEC.md` now settles the defaults the spec review asked about (the six changes and the default `SWWAF_WAF_DISABLED_RULES` in "Attack detection"), so this is built as written there. Body inspection (`SWWAF_WAF_BODY_LIMIT`) follows in its own issue, linked below once filed; checking the defaults against a running gitea stays with https://git.eeqj.de/sneak/smallwebwaf/issues/30. One PR to `next`.
- Coraza with the Core Rule Set 4.25.0, through the widely used Go module that embeds it, both pinned and recorded in `~/.claude/GO_PACKAGE_DEFAULTS.md`; `go.mod` and `go.sum` through `make tidy`.
- The method, the URL with its query and the headers of every request inspected where "Data flow for one request" puts it; no body, no response.
- `SWWAF_WAF_MODE` (`off`, `detect`, `block`, default `block`), `SWWAF_WAF_PARANOIA_LEVEL` (`1`), `SWWAF_WAF_ANOMALY_THRESHOLD` (`5`), `SWWAF_WAF_DISABLED_RULES` (its default), `SWWAF_WAF_EXEMPT_PATHS`.
- The six changes to the Core Rule Set exactly as "Attack detection" gives them, none undoable by a setting.
- A match at or over the threshold refused with `403` in `block`, logged and alerted (`waf_block`) in `detect`; no ban for it, but the refusal counts toward the error burst of https://git.eeqj.de/sneak/smallwebwaf/issues/115 and is an offence in the history.
- The request log's `waf_rule_ids` and `waf_score`; metrics as "Metrics endpoint" gives them; `README.md` documents it all, the six changes included.
Definition of done: tests show sample attacks in the query, path and headers refused in `block` and only logged in `detect`, each of the six changes letting its ordinary gitea request through (the examples in `SPEC.md`), the disabled and exempt settings, `off`, and the log fields, alert and metrics; each test failing with its rule broken; `make check` and `make example-app` green; one PR to `next`, passed by a reviewer who did not write it.
Model: opus-5-5
clawbot
self-assigned this 2026-10-08 03:38:46 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The OWASP Core Rule Set run by Coraza, as
SPEC.md(#9) describes. The spec's third review (#9 (comment)) found that at its defaults it still refuses ordinary traffic; the spec settles that before this is built.Not scheduled: it waits for sneak to put it in a milestone.
Model: opus-5-5
Plan. The build order in
SPEC.mdputs attack detection with Coraza and the Core Rule Set in the last stage, after the reputation sources.SPEC.mdnow settles the defaults the spec review asked about (the six changes and the defaultSWWAF_WAF_DISABLED_RULESin "Attack detection"), so this is built as written there. Body inspection (SWWAF_WAF_BODY_LIMIT) follows in its own issue, linked below once filed; checking the defaults against a running gitea stays with #30. One PR tonext.~/.claude/GO_PACKAGE_DEFAULTS.md;go.modandgo.sumthroughmake tidy.SWWAF_WAF_MODE(off,detect,block, defaultblock),SWWAF_WAF_PARANOIA_LEVEL(1),SWWAF_WAF_ANOMALY_THRESHOLD(5),SWWAF_WAF_DISABLED_RULES(its default),SWWAF_WAF_EXEMPT_PATHS.403inblock, logged and alerted (waf_block) indetect; no ban for it, but the refusal counts toward the error burst of #115 and is an offence in the history.waf_rule_idsandwaf_score; metrics as "Metrics endpoint" gives them;README.mddocuments it all, the six changes included.Definition of done: tests show sample attacks in the query, path and headers refused in
blockand only logged indetect, each of the six changes letting its ordinary gitea request through (the examples inSPEC.md), the disabled and exempt settings,off, and the log fields, alert and metrics; each test failing with its rule broken;make checkandmake example-appgreen; one PR tonext, passed by a reviewer who did not write it.Model: opus-5-5
Built in #121, for review.
Model: opus-5-5