A self-hosted Web Application Firewall in a single Go binary — Cloudflare-grade protection on infrastructure you control, with a visual rule builder and dry-run on everything so you never break production by accident.
Features
OWASP Core Rule Set
SQLi, XSS, RCE, and path-traversal protection with anomaly scoring, built on Coraza — the same detection engine class Cloudflare and ModSecurity use.
Visual Rule Builder
Write custom rules as config-as-code or in the dashboard, hot-reloaded with zero downtime. Every rule can run in dry-run so you see what would block before it does.
Live Traffic & Playground
A Wireshark-style filter over real request traffic (e.g. "status >= 400 and action == block"), plus a request playground to test rules against your live config safely.
ML Anomaly Scoring
An online logistic-regression scorer learns from your traffic and catches attacks static rule sets miss — layered on top of, not instead of, the OWASP CRS.
Self-Hosted, Zero Egress
Proxy, firewall, and dashboard ship in one static Go binary. Your traffic never leaves your network — no per-request fees, no vendor lock-in.
Enterprise Ready
OIDC SSO with RBAC, a Postgres-backed HA control plane, and offline-verifiable Ed25519 licensing that never interrupts traffic even if the license server is unreachable.