[rennf93]

Suggestion type

• Project
• Resource

Checklist

• I searched the list and existing issues for duplicates.
• I changed README_SOURCE.md, not the generated README.md.
• This pull request contains one suggestion.
• The suggestion is relevant to Java or the JVM and fits its chosen category.
• I used the canonical project or resource link.
• The suggestion is current and maintained.
• The concise, neutral description explains its distinguishing value and ends with punctuation.
• Licensing is clear and any restrictive terms are disclosed where applicable.

I'm the author. Spring Boot Guard is a Spring Boot 3 starter (com.guard-core:spring-boot-guard on Maven Central, latest 1.1.0) that adds request-level protection through auto-configuration: IP and country allow and deny lists, rate limiting with automatic IP bans, SQL injection and XSS pattern detection and security headers. Unlike Spring Security, which handles authentication and authorization, it filters hostile traffic before it reaches your controllers.

---

Summary by cubic

Adds Spring Boot Guard to the Security libraries section of the curated Java list.

• The starter filters hostile traffic with IP allow/deny lists, rate limiting plus automatic bans, injection and XSS detection, and security headers, complementing Spring Security's auth and authorization focus.

^{Written for commit 9d65804. Summary will update on new commits.}

Project background: Guard Core's first library is fastapi-guard, public since August 2024 (first PyPI release, 0.1.0, on 2024-08-26). It has 825 GitHub stars, 65 releases and about 62,000 PyPI downloads in the last month (pypistats.org). The framework-agnostic engines and the adapters for other frameworks and languages came later and run the same detection rules, checked in CI against shared conformance fixtures.

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="README_SOURCE.md">

<violation number="1" location="README_SOURCE.md:1080">
P3: The description overstates coverage by saying attack detection runs “on every request,” although the library supports excluded paths and `@GuardBypass`. Remove that qualifier or describe detection as applying to incoming requests subject to configuration.</violation>

<violation number="2" location="README_SOURCE.md:1080">
P2: This entry omits the starter's documented Spring Boot 3.x compatibility. Add the supported major version so Boot 2.x or 4.x users do not infer compatibility from the generic “Spring Boot starter” wording.</violation>
</file>

<sub>Reply to a comment to ask cubic a question or push back. It learns from your replies.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This entry omits the starter's documented Spring Boot 3.x compatibility. Add the supported major version so Boot 2.x or 4.x users do not infer compatibility from the generic “Spring Boot starter” wording.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At README_SOURCE.md, line 1080:

<comment>This entry omits the starter's documented Spring Boot 3.x compatibility. Add the supported major version so Boot 2.x or 4.x users do not infer compatibility from the generic “Spring Boot starter” wording.</comment>

<file context>
@@ -1077,6 +1077,7 @@ _Libraries that handle security, authentication, authorization or session manage
 - [Topaz](https://github.com/aserto-dev/topaz) - Fine-grained authorization for applications with support for RBAC, ABAC, and ReBAC.
 - [WebAuthn4J](https://github.com/webauthn4j/webauthn4j) - Server-side WebAuthn and passkey verification library.
 - [MOSS](https://github.com/mosscomputing/moss-java) - Cryptographic signing for AI agents using ML-DSA-44 post-quantum signatures, creating audit trails for attribution and compliance.
+- [Spring Boot Guard](https://github.com/Guard-Core/spring-boot-guard) - Spring Boot starter for IP filtering, rate limiting with automatic bans and attack pattern detection on every request.
 
 ### Serialization
</file context>

Suggested change

	- [Spring Boot Guard](https://github.com/Guard-Core/spring-boot-guard) - Spring Boot starter for IP filtering, rate limiting with automatic bans and attack pattern detection on every request.
	- [Spring Boot Guard](https://github.com/Guard-Core/spring-boot-guard) - Spring Boot 3.x starter for IP filtering, rate limiting with automatic bans and attack pattern detection.

[cubic-dev-ai]

P3: The description overstates coverage by saying attack detection runs “on every request,” although the library supports excluded paths and @GuardBypass. Remove that qualifier or describe detection as applying to incoming requests subject to configuration.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At README_SOURCE.md, line 1080:

<comment>The description overstates coverage by saying attack detection runs “on every request,” although the library supports excluded paths and `@GuardBypass`. Remove that qualifier or describe detection as applying to incoming requests subject to configuration.</comment>

<file context>
@@ -1077,6 +1077,7 @@ _Libraries that handle security, authentication, authorization or session manage
 - [Topaz](https://github.com/aserto-dev/topaz) - Fine-grained authorization for applications with support for RBAC, ABAC, and ReBAC.
 - [WebAuthn4J](https://github.com/webauthn4j/webauthn4j) - Server-side WebAuthn and passkey verification library.
 - [MOSS](https://github.com/mosscomputing/moss-java) - Cryptographic signing for AI agents using ML-DSA-44 post-quantum signatures, creating audit trails for attribution and compliance.
+- [Spring Boot Guard](https://github.com/Guard-Core/spring-boot-guard) - Spring Boot starter for IP filtering, rate limiting with automatic bans and attack pattern detection on every request.
 
 ### Serialization
</file context>

Suggested change

	- [Spring Boot Guard](https://github.com/Guard-Core/spring-boot-guard) - Spring Boot starter for IP filtering, rate limiting with automatic bans and attack pattern detection on every request.
	- [Spring Boot Guard](https://github.com/Guard-Core/spring-boot-guard) - Spring Boot starter for IP filtering, rate limiting with automatic bans and attack pattern detection.