🛡️ MyZubster Security Guide: JWT, UFW, AI-Powered Protection & New Contributor
How we transformed a decentralized marketplace into a self-defending fortress—and welcomed our first community contributor on GitHub.
🌱 The Journey Continues
MyZubster is an open-source decentralized marketplace that uses Monero (XMR) for private payments. After successfully deploying the core ecosystem (Gateway, Marketplace, Frontend), we focused on security hardening and automated threat detection.
This guide covers:
Security vulnerabilities identified and fixed
JWT Authentication implementation
UFW Firewall configuration
AI-Powered Security Bot with DeepSeek
How to contribute to the project on GitHub
Our first new contributor!
🔍 Security Audit: What We Found
Using automated scans (nmap, nikto, sqlmap, gobuster) and DeepSeek AI analysis, we identified:
Vulnerability Severity Status
API endpoints exposed without authentication 🔴 Critical ✅ Fixed
No rate limiting on API 🟡 High ✅ Fixed
Missing security headers (X-Frame-Options, etc.) 🟡 Medium ✅ Fixed
PostgreSQL exposed locally 🟢 Low ✅ Disabled
Gobuster returning 200 on non-existent paths 🟢 Low ✅ Fixed
🛡️ Security Hardening Actions
1️⃣ JWT Authentication for All API Endpoints
File: server.js
javascript
const jwt = require('jsonwebtoken');
const authenticate = (req, res, next) => {
// Public routes (no authentication required)
const publicRoutes = [
'/api/health',
'/api/auth/login',
'/api/auth/register'
];
if (publicRoutes.includes(req.path)) {
return next();
}
const authHeader = req.headers.authorization;
if (!authHeader) {
return res.status(401).json({ error: 'Token required' });
}
try {
const token = authHeader.split(' ')[1];
const decoded = jwt.verify(token, process.env.JWT_SECRET);
req.user = decoded;
next();
} catch (error) {
return res.status(401).json({ error: 'Invalid or expired token' });
}
};
app.use('/api', authenticate);
Environment Variables (.env):
env
JWT_SECRET=your_generated_secure_key
JWT_EXPIRES_IN=7d
API_KEY=your_api_key
2️⃣ Rate Limiting
File: server.js
javascript
const rateLimit = require('express-rate-limit');
// Global rate limiter
const globalLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // max 100 requests per IP
message: 'Too many requests, please try again later',
standardHeaders: true,
legacyHeaders: false,
});
// Stricter for authentication endpoints
const authLimiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 5, // max 5 login attempts
message: 'Too many login attempts, please try again later',
});
app.use('/api', globalLimiter);
app.use('/api/auth/login', authLimiter);
app.use('/api/auth/register', authLimiter);
3️⃣ UFW Firewall Configuration
File: setup-ufw.sh
bash
!/bin/bash
MyZubster UFW Firewall Configuration
Set default policies
ufw default deny incoming
ufw default allow outgoing
SSH - only from your IP
ufw allow from YOUR_IP to any port 22
HTTP/HTTPS (public)
ufw allow 80/tcp
ufw allow 443/tcp
API - only from your IP
ufw allow from YOUR_IP to any port 3001
ufw allow from YOUR_IP to any port 4000
Enable logging
ufw logging on
Activate
ufw enable
Apply the rules:
bash
sudo chmod +x setup-ufw.sh
sudo ./setup-ufw.sh
Verify:
bash
sudo ufw status verbose
4️⃣ Security Headers (Nginx)
File: /etc/nginx/nginx.conf
nginx
http {
# Security headers
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
# Hide server version
server_tokens off;
# Limit request size
client_max_body_size 10M;
}
Apply:
bash
sudo nginx -t
sudo systemctl reload nginx
🤖 AI-Powered Security Bot
I built a Python security bot that:
Scans the infrastructure using Kali Linux tools
Analyzes results locally with DeepSeek AI (Ollama)
Blocks suspicious IPs automatically with UFW
Generates detailed JSON reports
Install Ollama & DeepSeek
bash
Install Ollama
curl -fsSL https://ollama.com/install.sh | sh
Download DeepSeek model
ollama pull deepseek-r1:1.5b
Verify
ollama list
Security Bot Code
File: security/security_bot.py
python
!/usr/bin/env python3
import subprocess
import json
import logging
import datetime
import requests
LOG_FILE = "/var/log/security_bot.log"
DEEPSEEK_URL = "http://localhost:11434/api/generate"
DEEPSEEK_MODEL = "deepseek-r1:1.5b"
def run_nmap():
cmd = "nmap -sV --script=default localhost"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
return result.stdout + result.stderr
def run_nikto():
cmd = "nikto -h https://myzubster.com -ssl"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
return result.stdout + result.stderr
def run_sqlmap():
cmd = "sqlmap -u localhost --batch --level=1 --risk=1"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
return result.stdout + result.stderr
def run_gobuster():
wordlist = "/usr/share/wordlists/dirb/common.txt"
cmd = f"gobuster dir -u localhost -w {wordlist} -t 50 --no-error"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
return result.stdout + result.stderr
def analyze_with_deepseek(results):
prompt = f"Analyze these security scan results:\n{results[:800]}"
response = requests.post(DEEPSEEK_URL, json={
"model": DEEPSEEK_MODEL,
"prompt": prompt,
"stream": False
}, timeout=180)
return response.json().get("response", "No response")
def main():
logging.info("🚀 Starting security scan")
results = {
"timestamp": datetime.datetime.now().isoformat(),
"scans": {
"nmap": run_nmap(),
"nikto": run_nikto(),
"sqlmap": run_sqlmap(),
"gobuster": run_gobuster()
}
}
# AI Analysis
all_results = "\n".join([f"{k}:\n{v}" for k, v in results["scans"].items()])
results["deepseek_analysis"] = analyze_with_deepseek(all_results)
# Block suspicious IPs
if results["deepseek_analysis"] and "critical" in results["deepseek_analysis"].lower():
subprocess.run("sudo ufw deny from 192.168.1.100", shell=True)
# Save report
timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
report_file = f"/var/log/security_report_{timestamp}.json"
with open(report_file, 'w') as f:
json.dump(results, f, indent=2)
logging.info(f"✅ Report saved to {report_file}")
if name == "main":
main()
Run the Security Bot
bash
cd ~/MyZubsterGateway/security
chmod +x security_bot.py
nohup python3 security_bot.py > /var/log/security_bot.log 2>&1 &
View logs
tail -f /var/log/security_bot.log
Automate with Cron
bash
crontab -e
Add this line to run every hour
0 * * * * /usr/bin/python3 /root/MyZubsterGateway/security/security_bot.py >> /var/log/security_bot.log 2>&1
📊 Sample Security Report
json
{
"timestamp": "2026-07-26T05:27:45.339867",
"target": "localhost",
"scans": {
"nmap": "22/tcp open ssh OpenSSH 9.6p1...",
"nikto": "SSL Info: Subject: /CN=myzubster.com...",
"sqlmap": "All tested parameters are not injectable...",
"gobuster": "No vulnerabilities found..."
},
"deepseek_analysis": "Security Analysis:\n1. SSH configuration is secure\n2. Nginx SSL certificate valid until Oct 2026\n3. Recommendations: Update Nginx, add security headers"
}
🎯 Security Bot Features Summary
Feature Status Description
nmap ✅ Port scanning and service detection
nikto ✅ Web vulnerability scanning
sqlmap ✅ SQL injection testing
gobuster ✅ Directory enumeration
DeepSeek AI ✅ Automated analysis
UFW Integration ✅ Automatic IP blocking
JSON Reports ✅ Detailed logging
Cron Automation ✅ Hourly scans
🌟 New Contributor on GitHub! 🎉
We are thrilled to welcome @rossieugenio17 as the first community contributor to the MyZubster project!
Contributions Made:
✅ Security hardening implementation
✅ JWT authentication setup
✅ UFW firewall configuration
✅ AI-powered security bot integration
✅ Documentation and guides
How to Join the Community
We welcome developers interested in:
Blockchain (Monero, Tari)
Security (Penetration testing, AI analysis)
Frontend (React, Vite)
DevOps (Docker, Nginx, CI/CD)
Repository Links
Repository Description Stars
MyZubsterGateway Monero payment engine ⭐ 3
MyZubster-Marketplace Backend API ⭐ 1
myzubster-frontend React frontend ⭐ 0
MyZubster-App Mobile app ⭐ 1
tari-nft-template NFT template ⭐ 1
How to Contribute
Fork the repository
Create a feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add some amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request
Good First Issues
[Good First Issue] Creare pagina di Health Check per la dashboard
[Good First Issue] Aggiungere test per endpoint bookings
□
Improve admin dashboard UI
□
Add webhook integration tests
□
Write documentation tutorials
💡 Lessons Learned
Security is a process, not a one-time fix – Regular scans and AI analysis are essential.
JWT authentication is non-negotiable – APIs must be protected from unauthorized access.
Rate limiting prevents abuse – Simple but effective against DoS attacks.
Local AI is a game changer – DeepSeek running via Ollama provides intelligent analysis without sending data to third parties.
UFW is simple but powerful – A few firewall rules dramatically reduce the attack surface.
Automation saves time – The security bot runs hourly, producing detailed reports.
Open source thrives on contributions – New contributors bring fresh perspectives and improvements.
🔮 Next Steps
Deploy the Mobile App to Google Play Store
Integrate NFC payments for physical interactions
Implement DAO Governance for community decisions
Complete Security Audit with third-party tools
Add more NFT functionality for real-world asset tokenization
🌐 Connect with Us
Follow the development of MyZubster and connect with us on social media:
Blog: DEV.to - Daniel Ioni
X (Twitter): @myzubster
LinkedIn: Daniel Ioni
GitHub: DanielIoni-creator
TikTok: @h4x0r_23
📋 Quick Reference: All Security Commands
bash
Check UFW status
sudo ufw status verbose
View latest security report
ls -la /var/log/security_report_.json | tail -1
cat $(ls -t /var/log/security_report_.json | head -1) | python3 -m json.tool
Run security bot manually
cd ~/MyZubsterGateway/security
python3 security_bot.py
View security bot logs
tail -f /var/log/security_bot.log
Test DeepSeek AI
curl -X POST http://localhost:11434/api/generate -d '{
"model": "deepseek-r1:1.5b",
"prompt": "Security analysis test",
"stream": false
}' -H "Content-Type: application/json"
Built with ❤️ for Monero, Tari, and the open-source community. 🌱
Originally published on DEV.to🚀
🌐 Connect with Me
Follow the development of MyZubster and connect with me on social media:
- Blog: DEV.to - Daniel Ioni
- X (Twitter): @myzubster
- LinkedIn: Daniel Ioni
- GitHub: DanielIoni-creator
- TikTok: @h4x0r_23
Top comments (0)