Aftermarket Adds AfterGuard to Put a Lock on Old Apps That Have None

Aftermarket has a seventh tool. AfterGuard, run as aftermarket guard, stands in front of an app that can’t protect itself, such as an old admin panel with no login, and turns away whatever its rules don’t allow. API keys and Basic logins are kept as hashes, failed logins and request rates are limited per address, and the app learns who called from a header the client can’t forge. A threat model was written and approved before any code.

The case study puts a stand-in panel behind it: the debug page that printed a password answers 404, the admin pages want the admin login from the office network, and the sixth wrong password gets 429.

Any request that could be read two ways, such as /status/..%2fadmin or one with both Content-Length and Transfer-Encoding, gets 400. Go’s own server quietly accepts some of these, so AfterGuard reads the raw bytes itself. A review before release still broke that reader four ways. All were fixed, and the suite now has 404 tests. Binaries are out for Linux, macOS and Windows. The previous note covers AfterHook.