Input Sanitization & Security Packages
Input sanitization, XSS prevention, and application-security utilities that clean untrusted input before it reaches your rendering or storage layer (DOMPurify).
Packages in Input Sanitization & Security
Kind
Sort:Used by Most Apps
secrecy
Rust wrapper types that keep secrets out of logs, debug output, and Clone/Copy, and securely wipe them from memory on drop
enshrined/svg-sanitize
A PHP SVG/XML sanitizer that strips malicious markup from untrusted SVGs
secure
Standard net/http middleware that adds HSTS, CSP, X-Frame-Options, and other security headers to any Go web app in a few lines.
slowapi
Rate limiting for Starlette and FastAPI endpoints, adapted from Flask-Limiter.
@fastify/rate-limit
A low-overhead rate limiter for Fastify routes, with in-memory or Redis-backed request tracking.
RE2JS
Linear-time, ReDoS-safe regular expression engine for JavaScript
lxml_html_clean
Standalone HTML cleaner extracted from lxml.html.clean for stripping scripts, styles, and unsafe attributes from untrusted HTML.
Anthropic Sandbox Runtime
Wraps any command in OS-native filesystem and network sandboxing, without requiring a container.
cors
Configurable CORS middleware for the Gin web framework in Go, with fine-grained origin, header, and credential rules.
zxcvbn-ts
A TypeScript rewrite of Dropbox's zxcvbn password strength estimator, with pluggable dictionaries and async matcher support.
react-google-recaptcha
React component wrapper for Google reCAPTCHA v2, handling script loading, widget rendering, and the execute/reset API out of the box.
altcha
Privacy-first, self-hosted CAPTCHA replacement that proves a visitor is human with invisible proof-of-work instead of puzzles, tracking, or third-party APIs.
hono-rate-limiter
Rate limiting middleware for Hono with pluggable memory, Redis, Cloudflare, and Unstorage backends, plus WebSocket support.
Purify
A Laravel wrapper around HTMLPurifier that sanitizes untrusted HTML through a fluent facade, Eloquent casts, and configurable purification profiles.
remark-html
A remark plugin that compiles markdown syntax trees directly into sanitized HTML strings.
safe-regex
Detects regular expressions prone to catastrophic backtracking (ReDoS) using AST-based star-height analysis.
check-password-strength
A lightweight, fully-typed password strength checker built on plain JavaScript regex rules.
proxy-addr
Determine the real client IP address behind trusted proxies, with full IPv4, IPv6, and CIDR support.
csrf-sync
Stateful CSRF protection for Express using the Synchronizer Token Pattern, built to replace the deprecated csurf package.
sanitize-filename
A basic filename sanitizer for Rust, ported from Node's sanitize-filename
is-localhost-ip
Checks whether a hostname or IPv4/IPv6 address resolves to the local machine or a private network
re2
A fast, safe Python binding for Google's RE2 regular expression engine, offering a near drop-in replacement for the re module with a linear-time matching guarantee.
disposable-email-domains
A community-maintained blocklist of disposable email domains for filtering throwaway signups.
HTML Purifier
A standards-compliant PHP library that filters untrusted HTML through robust whitelists to block XSS while keeping rich formatting intact.
