tlk-sentinel 1.1.0

Documentation and release plumbing. Detection and response are byte-for-byte what 1.0.0 shipped.

Two documents a security product should not have been missing

• docs/architecture.md — one log line traced from the file, through the engine, to the firewall, including why the community build cannot ban even if you edit the profile.
• docs/threat-model.md — mostly about the limits. Distributed low-and-slow traffic and IPv6 rotation walk straight past it. A spoofed proxy header lets an attacker choose whose address gets banned. Log injection, locking yourself out, and a poisoned reputation feed are the other three ways this becomes the risk.

Also

• SECURITY.md with a disclosure address, scope and a response window; the issue chooser points at it first.
• A licence permission table in the README, both languages, matching clauses 1 and 2 of LICENSE.
• This release carries a tarball and its SHA-256. The workflow refuses to publish unless the suite passes, the README's test count still matches it, and the public build comes out monitor-only.
• CI fails if any of the four places the README states a test count drifts from the suite.

Verify the download

sha256sum -c tlk-sentinel-v1.1.0.tar.gz.sha256

tlk-sentinel 1.0.0

No package is attached to this tag. Packaging only started with v1.1.0 — install from the latest release instead, or check out the v1.0.0 tag if you specifically need this revision of the source.

First public release of the community build.

Attacks show up in your logs long before they show up anywhere else. tlk-sentinel
reads those logs, decides which lines are an attack, bans the source, and shows you
what happened — one agent, no runtime dependencies, no database to install.

What it detects

• SSH — brute-force, invalid users, direct root login, on per-IP threshold windows.
• HTTP — SQLi, XSS, path traversal, probing for .env / wp-admin / phpmyadmin,
  request floods, and known scanner User-Agents (sqlmap, nikto, nuclei, gobuster…).
• Encoded payloads — requests are decoded before matching, so
  ?id=1%2520union%2520select%25201 is caught exactly like its plain form.
• Attacks with no signature — a behavioural score over request rate, path diversity,
  User-Agent churn and 4xx ratio, with a per-IP cooldown so one scanner cannot flood
  your alerts.
• Known-bad sources — offline CIDR reputation lists; a match escalates straight to
  critical. Optional country attribution.
• Tampering — sha256 baselines for the files you name in TLK_INTEGRITY.

What it does about it

Bans through nftables or ipset, escalating to ×4 for repeat offenders. Writes every
event to SQLite. Alerts to stdout and Discord. Serves a live dashboard over SSE with a
threat feed, severity split, ban list and one-click unban.

The firewall starts in dry-run. It logs the ban it would apply and writes no rule
until you set TLK_FW_DRYRUN=0 — watch it for a day first, then decide.

The panel binds to loopback. Exposing it anywhere else requires a token, or the agent
refuses to bind and tells you why. Every write endpoint validates its input: a value
that is not an IP address never reaches nft.

Same engine inside your app

WebGuard runs the identical ruleset as middleware in Next.js or any fetch-based
runtime, so a scanner probing your server and the same IP hammering your login
endpoint are one story instead of two.

Install

Node 22.5+, nothing else.

git clone https://github.com/Talkdedsec/tlk-sentinel /opt/tlk-sentinel
cd /opt/tlk-sentinel && npm install && npm run build
cp .env.example .env && npm run agent

Turkish and English throughout, via TLK_LANG.

Verification

60 tests on Node's built-in runner. Four boot the real agent against a live log file
and assert against the panel API. CI runs on Linux and Windows, Node 22 and 24.

License

Source-available: run it, read it, modify it for your own use. Selling or
redistributing it is not permitted. Commercial licensing: talkdedsec@proton.me