Security Settings

Besides Attack Mode, the Temps proxy applies three protections you configure: security headers on your apps' responses, an instance-wide IP access list, and vulnerability scans of deployed images. Security headers are off by default, the IP list blocks or allows addresses before a request reaches any app, and scans need Trivy on the Temps server. For the full security overview, see Security.

Security headers

Security headers are configured exclusively via the dashboard or API -- there is no dedicated CLI command for this feature.

Temps can add four HTTP security headers to every response from your deployed applications: Content-Security-Policy, X-Frame-Options, Strict-Transport-Security and Referrer-Policy. They are off until you enable them, globally or for a project. A project that has its own security-headers setting uses it instead of the global one; the two are not merged.

Project presets

In Project Settings → Security → Security Headers, turn on Enable Security Headers and pick a preset. These are the exact values the proxy sends:

Note that Strict is not stricter on scripts: it adds 'unsafe-eval', which Moderate does not allow. It is stricter on framing (DENY, frame-ancestors 'none'), connect-src, base-uri, form targets, referrers and HSTS preload. With Custom, only the headers you fill in are sent, and values you fill in under Custom keep being sent even if you switch back to a preset afterwards; clear them first. Turning the project's switch off, or setting the preset to disabled through the API (the dashboard has no Disabled option), sends no headers for that project and does not fall back to the global setting. The project's Enable Security Headers switch and its Rate Limiting switch save the same field, so they turn on and off together.

Global setting

Settings → Security → Security Headers applies to every project without its own security-headers setting. When you enable it, the proxy sends these stored values:

The global Security Preset selector (default Moderate) stores the preset name but does not change these values in v0.1.0-beta.56: picking Strict or Permissive there sends the same four values. To change what the global setting sends, choose Custom and edit the fields.

Configuring Headers

1. Global:  Settings → Security → Security Headers
2. Project: Project Settings → Security → Security Headers

IP access control

Block clients by IP address or CIDR range at the proxy, before requests reach your applications. There is one list for the whole instance, so every block rule applies to every project.

# Block an IP
curl -X POST ".../api/ip-access-control" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "ip_address": "192.168.1.100",
    "action": "block",
    "reason": "Suspicious activity"
  }'

# Check if an IP is blocked
curl ".../api/ip-access-control/check/192.168.1.100" \
  -H "Authorization: Bearer YOUR_TOKEN"

Vulnerability scanning

Temps automatically scans your deployed Docker images for known vulnerabilities using Trivy, an open-source security scanner. Scans run daily at midnight UTC and can also be triggered manually.

What Gets Scanned

• OS packages (Alpine, Debian, Ubuntu, etc.) -- detects CVEs in system libraries
• Language packages (npm, pip, Go modules, etc.) -- detects CVEs in application dependencies
• Container configuration -- checks for security misconfigurations

Severity Levels

Viewing Scan Results

1. Go to Projects and select your project
2. Vulnerability scan results appear in the project overview
3. Each scan shows total count and breakdown by severity (critical, high, medium, low)
4. Click into a scan to see individual CVEs with package names, installed versions, fixed versions, and CVSS scores

Triggering a Manual Scan

# Via API
curl -X POST "https://your-temps-instance.com/api/projects/{project_id}/scans" \
  -H "Authorization: Bearer YOUR_TOKEN"

# View latest scan results
curl "https://your-temps-instance.com/api/projects/{project_id}/scans/latest" \
  -H "Authorization: Bearer YOUR_TOKEN"

# View vulnerabilities for a specific scan
curl "https://your-temps-instance.com/api/projects/{project_id}/scans/{scan_id}/vulnerabilities" \
  -H "Authorization: Bearer YOUR_TOKEN"

Configuration inheritance

Security headers can be set globally and per project. A project with its own security-headers setting uses it in full (including "off"); otherwise the global setting applies. Environment-level header settings are stored but ignored in v0.1.0-beta.56. The IP access list has a single instance-wide level. Attack mode resolves differently (an environment value overrides the project value); see Attack Mode.