Skip to main content

​
Network boundary

nablr makes exactly one category of outbound network call: license validation to nablr-api.nablrco.workers.dev. Your code is never sent anywhere. All scanners, codebase mapping, and workflow tools run entirely locally via AST analysis.

​
Firewall allowlist

If your environment blocks outbound traffic, allowlist:
Only one domain, one port. All traffic is TLS 1.2+.

​
Airgap proof

Run the included airgap verification script to confirm no unexpected outbound calls:
The script installs a socket-level firewall and exercises the full prompt generation path. Any unexpected connection attempt raises an error and fails the test.

​
Offline / airgap operation

After activating a key, paid assets are cached locally in a restricted-permission directory. Subsequent prompt generation requires zero network calls. All cache files are chmod 600 - readable only by the current user.

​
Key security

  • Keys are sent only in the Authorization: Bearer header - never in request bodies or URLs
  • Keys are cached locally with chmod 600 (owner-only read/write)
  • The last 4 characters are logged when NABLR_AUDIT_LOG=1 is set - full key is never logged

​
Audit logging

Enable structured JSON audit logs for all license requests:
Logs include: timestamp, endpoint, HTTP status, key suffix (last 4 chars), response time. Sent to stderr.

​
Dependency audit

Scans for hardcoded secrets, dangerous file operations, network import violations, and AI anti-patterns across the entire codebase.