network-exposure-baseline

To prevent accidental public network exposure in docker-compose ports mappings, classify bind targets using an allowlist and blocklist that enforces safe defaults like loopback or Tailscale ranges. It blocks public listeners without a valid justification and validates ports and expose mappings against a tiered policy.

A Tier 3 justification for public network exposure requires an explanation plus an unexpired x-exposure-expires date that is 90 days or less from the file's last modification time. It enforces time-bounded public listener rules across Redis, Postgres, and Docker configurations.

Secure Redis and Postgres listener settings by parsing redis.conf bind and protected-mode alongside postgresql.conf listen addresses to classify targets into tiered exposure levels. It enforces a fail-closed blocklist for malformed or missing network bind justifications.

Yes, the network exposure baseline supports systemd socket activation and UFW firewall rules by parsing systemd .socket ListenStream units and firewall configurations to classify bind targets. It enforces allowlist and blocklist policies across these infrastructure surfaces.

If a public port exposure justification is missing or malformed, the verifier scripts enforce fail-closed behavior by hard-blocking the configuration change. This prevents breaches-by-default by rejecting invalid or unclassified network bind targets.