# Gamertan Web Foundations > Status: unreleased development work toward `v0.1.0-preview.1`. No install > coordinate is promised until the reviewed public snapshot is tagged. Small, composable Go packages for the unglamorous boundaries of a careful web application: request identity, structured request logs, browser security, passwords and sessions, permissions, SQLite persistence, and private analytics. This is a toolkit, not an application framework. Your application keeps its router, HTTP policy, HTML, authorization decisions, cache behavior, and deployment. Each package works with `net/http` and can be adopted independently. The first preview targets modest Linux servers, local files, SQLite, and normal Go binaries. It requires no Redis, message broker, hosted identity provider, telemetry service, or JavaScript framework. ## Packages - `requestmeta`: trusted-proxy resolution, HTTPS/origin metadata, and request IDs. - `requestlog`: bounded versioned records, middleware, sinks, and private JSONL. - `websec`: headers, origin checks, CSRF, redirects, body limits, and rate limits. - `abuse`: application-classified request abuse with pluggable persistence. - `auth`, `authhttp`, `authsqlite`: passwords, sessions, permissions, cookies, and a no-CGO SQLite adapter. - `analytics`: safe and sensitive aggregate projections over request records. The copyable starter under `starters/basic` demonstrates the packages without turning them into a router or template system. ## Security boundary Client addresses are accepted from forwarding headers only when the immediate peer and every skipped proxy are explicitly trusted. Sensitive request fields are off by default. Cryptographic entropy failures fail closed. Logs and account databases remain private application data and never belong in source releases. See [SECURITY.md](SECURITY.md), [docs/THREAT_MODEL.md](docs/THREAT_MODEL.md), the [application adoption contract](docs/ADOPTION.md), and [docs/SERVICES_ROADMAP.md](docs/SERVICES_ROADMAP.md). ## Licensing This is a multi-license repository with exact file-level SPDX identifiers: - embeddable packages and adapters: MPL-2.0; - future standalone network services and operational machinery: AGPL-3.0-only; - starters, examples, and reusable configuration: 0BSD. See [LICENSES.md](LICENSES.md). No standalone auth or logging server is included in this preview.