Week 11: GuardScript - Security Hardening and Access Control

1. Objectives

  • Review and strengthen the most important backend security mechanisms in GuardScript.
  • Standardize access control flow across workspace, project, and license boundaries.
  • Improve system observability through logging, audit trails, and realtime events.

2. Weekly Tasks Breakdown

DayMain TaskTechnical DetailsStatus
MonLoader v2 Review- Checked request signatures, timestamp and nonce validation.
- Reviewed response signature handling in the execute flow.		Completed
TueLoader v3 Review- Verified the X25519 and AES-GCM handshake flow.
- Compared the loader security flow against the current implementation.		Completed
WedAuth and License Hardening- Reviewed auth utilities, PBKDF2 password hashing, password rotation, and rate limiting.
- Standardized license active/inactive state, expiration, project binding, and HWID lock/reset behavior.		Completed
ThuAccess Control- Completed workspace-level access list handling.
- Checked whitelist, blacklist, and IP-based restriction logic.		Completed
FriLogging, Audit, and Realtime- Reviewed workspace logs, admin audit, and realtime broadcasts.
- Checked workspace, user, and admin event channels.		Completed

3. Outcomes

  • Script protection and request verification mechanisms were aligned more closely with the implemented security model in the codebase.
  • License, HWID, and access-control flow became more consistent with the loader execution path.
  • System observability improved through logs, audit trail support, and realtime events.

4. Issues & Solutions

  • Issue: The hardening phase required balancing stronger security with compatibility for the existing usage flow.
  • Solution: Preserved the API surface while tightening validation, signatures, permission checks, and event logging.

5. Next Steps

  • Finalize technical documentation so it accurately reflects the implementation.
  • Prepare testing, deployment, and demo checklists.