https://bouine.org/v0.4/docs/contributing/Recent content in Contributing on bouineHugoenhttps://bouine.org/v0.4/docs/contributing/codebase/Mon, 01 Jan 0001 00:00:00 +0000https://bouine.org/v0.4/docs/contributing/codebase/<h2 id="package-map">Package map</h2> <table> <thead> <tr> <th>Package</th> <th style="text-align: right">Layer</th> <th>Purpose</th> </tr> </thead> <tbody> <tr> <td><code>internal/server</code></td> <td style="text-align: right">L1</td> <td>HTTP/1.1, TLS, route matching</td> </tr> <tr> <td><code>internal/storage</code></td> <td style="text-align: right">L2</td> <td>Hot store, warm tier, WAL, SIEVE</td> </tr> <tr> <td><code>internal/cache</code></td> <td style="text-align: right">L3</td> <td>RFC 9111 state machine and handler</td> </tr> <tr> <td><code>internal/origin</code></td> <td style="text-align: right">L4</td> <td>Upstream pools, health checks, hedged transport</td> </tr> <tr> <td><code>internal/cluster</code></td> <td style="text-align: right">L5</td> <td>memberlist gossip, hash ring, peer fetch</td> </tr> <tr> <td><code>internal/admin</code></td> <td style="text-align: right">L6</td> <td>Admin HTTP API</td> </tr> <tr> <td><code>internal/observability</code></td> <td style="text-align: right">L7</td> <td>Metrics, logs, access log</td> </tr> </tbody> </table> <p>| <code>pkg/api</code> | public | Wire types shared by SDK and admin | | <code>pkg/bouineapi</code> | public | Go SDK |</p>https://bouine.org/v0.4/docs/contributing/security/Mon, 01 Jan 0001 00:00:00 +0000https://bouine.org/v0.4/docs/contributing/security/<p>Report security issues via GitHub&rsquo;s <a class="link link--text" href="https://github.com/bouine-cache/bouine/security/advisories/new" rel="external">Private vulnerability reporting</a> — it creates a tracked, embargoed advisory. No security email alias is published.</p> <h2 id="scope">Scope</h2> <ul> <li>bouine binary</li> <li>Helm chart</li> <li>Container image</li> <li>Go SDK</li> </ul> <h2 id="examples-of-high-impact-issues">Examples of high-impact issues</h2> <ul> <li>Cache poisoning that leaks one user&rsquo;s response to another</li> <li>HTTP request smuggling through the data plane</li> <li>Admin API authentication bypass</li> <li>Peer impersonation in cluster mode</li> <li>Path traversal in warm-tier storage</li> </ul> <h2 id="hardening-checklist">Hardening checklist</h2> <ul> <li>Keep admin port private; expose only through internal network or mTLS.</li> <li>Use TLS verification for upstreams.</li> <li>Run containers as non-root.</li> <li>Use NetworkPolicy for cluster and admin ports.</li> <li>Monitor purge/ban rates for misuse.</li> <li>Do not log request/response bodies or credentials.</li> </ul>