Heightproof is a security-focused project, but the current implementation is still an MVP.
Please open a private security advisory or contact the maintainer before publishing details about exploitable vulnerabilities.
Heightproof currently provides:
- API event collection
- Metadata redaction
- Threat scoring
- Incident creation
- Self-hosted deployment
Heightproof does not replace:
- A WAF
- API authentication
- Authorization checks
- Vulnerability scanning
- Packet inspection
- Full SIEM tooling
Do not send production secrets in request bodies or headers. Heightproof includes configurable redaction, but applications should still avoid collecting sensitive data whenever possible.