Light WAF inspects every request, scores it against your rules, and blocks when the score crosses the line — with a control panel that shows you exactly why.
Every module that matches contributes points by severity. When the cumulative anomaly score crosses your block threshold, the request is denied. Tuning the WAF is tuning that one relationship — not editing rules by hand.
Connection, headers, body — native detectors and CRS rules examine each request as it's read, in order.
A critical adds 6, a warning 3, a notice 2. Two weak signals together weigh as much as one strong one.
At the threshold the verdict flips to blocked — and the full breakdown is stored for the drill-down.
All of it is open source. Everything beyond the core is opt-in and default-off — turn it all off and you have exactly the standalone core WAF.
SQLi, XSS, RCE, path traversal, SSRF, LDAP/NoSQL/SSTI and more — plus the CRS rule engine — score every request cooperatively.
One token-bucket budget shared across every node via Redis, with atomic server-side accounting. No node over-allows.
Score client IPs from your blocklists; a single-writer feed keeps the shared reputation fresh and self-expiring.
Hitless ACME certificates (TLS-ALPN-01 or DNS-01 wildcards), plus mutual-TLS client auth. Fail-closed, never a silent downgrade.
Validate every GraphQL, gRPC and REST request against your app's real schema or OpenAPI spec — a route or field the real client never sends is a probing signal.
Extend detection with your own WASM modules, gated by a detached minisign signature. A plugin that fails verification never loads.
A single pane over the whole cluster: block rate, traffic disposition, denied-event volume and per-node latency.
Open any blocked request and see the accumulated score broken down per rule and severity — exactly why it was stopped.
Optionally capture the complete denied request — headers, cookies and body — off the data path. Redacted node-side, short retention, RBAC-gated and audited on every view.
Fire on per-IP or per-rule bursts within a window, with cooldowns, and push to a webhook. Attack signatures surface themselves.
Publish and roll back ruleset versions from the dashboard; a per-node agent validates and hot-reloads, and you watch convergence.
Helm charts and a WafProxy operator run a hardened WAF per workload, with GitOps and Gateway API examples. Images stay in your registry.
Viewer / operator / admin roles, local accounts, and OpenID Connect single sign-on backed by HttpOnly session cookies.
Every action is written to a hash-chained, Ed25519-signed log — tamper-evident and verifiable on demand.
Generate a signed SOC2 / PCI evidence bundle for any period — access control, audit integrity, WAF effectiveness, incidents.
Push denied verdicts, audit records and alerts to your SIEM as versioned ECS-like NDJSON, at-least-once, with visible lag.
A React dashboard over the whole cluster: monitor traffic, drill into any blocked request, manage rules, and produce compliance evidence.
Start with the single binary. When you need a shared budget, managed certificates, a dashboard or an audit trail, switch binaries and turn on what you need — nothing to buy, nothing to fork.
The core: a complete, standalone WAF in one binary.
The core plus the components, for a governed fleet.
Everything is open source under Apache-2.0 — on GitHub, crates.io and GHCR. Run it, read it, and contribute.