Security, failure modes, and operations.
The reverse proxy is a privileged processor. Yabby’s security story is therefore blast-radius reduction, strict configuration, aggregate-only persistence, independent rollback, and honest operational gates—not a claim that an allowlist can stop a malicious deployment or that the service is risk-free.
Data-flow summary
| Stage | Transiently processed | Persisted |
|---|---|---|
| Visitor → edge | Request method, URL, headers, cookies, and body as needed to proxy the origin. | None of the raw request is written to analytics. |
| Edge → origin | Origin request and response, including application behaviour needed to serve the page. | None of the raw response, headers, body, or cookies. |
| Analytics write | Qualifying status, latency, allowlisted platform/content signal, and canonical path. | UTC-hour aggregate rows retained for 30 days. Breakdown rows are written only after five observations; lower-volume counters remain transient and may disappear at hour/retention boundaries. |
| Experiment | Assignment cookie and signed click token while validating and routing. | Exposure, click, selector-miss, and unsupported-transformation counters only. |
Failure independence
- Analytics writes use waitUntil-style background work and must not block the proxied response; write failures are logged as operational failures, not surfaced as page failures.
- If no active experiment exists, the proxy returns the origin response without HTML transformation. Active experiments are explicitly non-cacheable.
- A customer-controlled DNS rollback remains the primary bypass. Yabby does not claim a fail-open guarantee; rollback timing and production routing must be tested per customer.
- Cloudflare account compromise, malicious deployment, or a compromised origin remains outside an application selector allowlist’s ability to prevent.
Origin authentication
Implemented for the lab; customer rollout control.
The lab origin accepts only Cloudflare IPv4/IPv6 network traffic and validates X-Yabby-Origin-Key-Id, X-Yabby-Origin-Timestamp, and X-Yabby-Origin-Signature. The signature covers the method, public host, path, query string, and a five-minute clock-skew window. The WordPress validator fails closed when the headers are missing, malformed, stale, or invalid.
This is defence in depth, not a guarantee against a compromised Worker. Customers remain responsible for firewall rules, origin certificate configuration, direct-origin exposure, emergency bypass, and per-site secret handling. Multi-customer secret management and rotation evidence are not complete.
Operational evidence to provide
- Source/build provenance and deployment permissions.
- Forwarded-header, cookie, cache, compression, CSP, and redirect matrix.
- Secret issuance, overlapping-key rotation, revocation, and incident-notification procedure. The current five-minute signature window is not nonce-based replay prevention.
- Test results for Host confusion, cache poisoning, direct-origin access, origin failure, malformed experiments, CSP bypass, and analytics-write failure.
- Support coverage and patch ownership stated in the order form or service terms.