·
Last changedVersion:
This version passed the hardening gate. Hardening applied 7 targeted changes and preserved all other text. Classified findings before hardening: 0. Classified findings closed: 0. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 9. Review findings remaining: 0.
None
None
Expand | File | Group | Subtype | Severity | Status |
|---|
No findings available
0 findings
Encore's cache is a typed wrapper around Redis. Declare a CacheCluster once, then create Keyspace objects for each shape of data you need.
Reference a cluster from another service: const cluster = CacheCluster.named("my-cache");
Keyspaces on a shared cluster are not isolated from each other. Start each key pattern with the owning service name. Let the owning service handle writes. Keep sensitive data in a separate cluster, and share data with other services through explicit APIs.
Eviction policies: "allkeys-lru" (default), "noeviction", "allkeys-lfu", "allkeys-random", "volatile-lru", "volatile-lfu", "volatile-ttl", "volatile-random". With "noeviction", writes fail with an error once memory is full.
Each keyspace has a key shape (used to build the Redis key from keyPattern) and a value type.
Wrap calls to setIfNotExists() in error handling that catches CacheKeyExists. Wrap calls to replace() in error handling that catches CacheMiss. Handle each case explicitly so the caller gets a clear result rather than a server error.
CacheCluster and keyspaces at package level.IntKeyspace for counters gives you atomic increment/decrement for free.get() returns undefined on miss. setIfNotExists() throws CacheKeyExists when the key is present, and replace() throws CacheMiss when the key is absent.userId from the authenticated caller rather than from request input. Check free-form fields such as resourcePath against an allowlist or a strict pattern that rejects the slash separator, so a value in one segment cannot collide with another key."allkeys-lru" policy, counters and tokens can be evicted under memory pressure. That resets rate limits and drops sessions. Keep security related counters and session data in a dedicated, adequately sized cluster using "noeviction" or a volatile policy. Treat limits backed by the cache as best effort, and choose explicitly whether to fail open or fail closed on cache errors.encore-database.increment before you rely on a counter for a fixed window. For fixed windows, include the current time window as a key field, and give every counter an expiry rather than neverExpire.encore-database (Postgres) or encore-bucket (object storage) instead.Get started with chainctlchainctl skill install public/encoredev/cache:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/encoredev/encore/cache:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md