<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Runtime Application Security — API Reference

## ModSecurity Commands

```bash
# Test configuration
nginx -t

# Reload with ModSecurity
nginx -s reload

# View audit log
tail -f /var/log/modsec_audit.log

# Update OWASP CRS
git -C /etc/modsecurity/crs pull origin main
```

## Falco Commands

```bash
# Run Falco
falco -r /etc/falco/falco_rules.yaml

# Test rules
falco -r rules.yaml --dry-run

# List loaded rules
falco --list

# JSON output
falco -r rules.yaml --json-output
```

## Security Header Values

| Header | Recommended Value |
|--------|------------------|
| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains; preload` |
| `Content-Security-Policy` | `default-src 'self'; script-src 'self'` |
| `X-Content-Type-Options` | `nosniff` |
| `X-Frame-Options` | `DENY` |
| `Referrer-Policy` | `strict-origin-when-cross-origin` |
| `Permissions-Policy` | `camera=(), microphone=(), geolocation=()` |

## Rate Limiting Recommendations

| Endpoint | Window | Max Requests |
|----------|--------|-------------|
| `/api/auth/login` | 15 min | 5 |
| `/api/auth/register` | 1 hour | 3 |
| `/api/*` | 15 min | 100 |
| `/api/upload` | 1 hour | 10 |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All checks passed |
| 1 | Security findings detected |
| 2 | Analysis error |
