18MB Go binary with embedded admin panel. 13 detection categories, 60 automated scenarios, multi-user accounts, and 16 languages. Protects your apps in under 5 minutes.
Runs as a HAProxy SPOE agent. Sub-millisecond verdicts via binary protocol. No Lua, no sidecar, no proxy chain.
4-layer intel: subscription whitelists, local GeoIP (1.37M nodes), FCrDNS bot verification, ProxyCheck API. VPN/TOR/proxy detection.
User-agent classification, path rules (regex/exact), rate limiting, pattern analysis. Catches scanners, brute-force, and path traversal.
IF/THEN rules: "If 10 threats in 30 minutes, ban for 24 hours and notify Slack." 10 pre-loaded scenarios. Build your own.
Real-time charts: threats/hour sparkline, top countries, verdict breakdown, top blocked IPs. World map heat visualization.
Slack, Discord, webhooks (HMAC-SHA256), PagerDuty, email. Surge detection alerts. Rate-limited dispatch.
12 tools for AI-assisted security ops via Claude Code. Investigate IPs, query threats, manage bans. SSE transport on port 8081.
18MB static Go binary with embedded Svelte 5 SPA. SQLite WAL database. Docker or bare metal. Zero external dependencies.
Built-in /metrics endpoint. Track evaluations, blocks, cache performance, API usage. Plug into Grafana.