// Application security
Protect an application from the edge to the data layer.
Point your nameservers at SecKav and every request is normalized, scored, and blocked or allowed at the edge in under 2 ms — no SDK, no code change.
// live inspection
Watch the engine make a decision on real traffic.
GET /?q=1 UNION SELECT password--
AttackSQL injection
Rulewaf.sqli.union
Score98 / 100
Actionngx.exit 403
hover a request to inspect its decision
User→Internet→Edge→Application→API→Data
Web Application Firewall
- SQLi, XSS, LFI, RFI, path traversal, RCE, Shellshock
- Obfuscation normalization (double-encode, comment strip)
- Zero-day virtual patching — CVE → generated Lua rule
- Custom rules, path scoping, IP & geo restrictions
- Request-sequence enforcement
Bot management
- AI-crawler control (GPTBot, ClaudeBot, Bytespider…)
- Headless / WebDriver detection via telemetry
- Credential-stuffing & scraper defense
- Actions: block · challenge · tarpit · decoy
Layer 7 DDoS
- Per-IP / per-session velocity tracking
- Penalty box — 0 ms edge drop (ngx.exit 444)
- Threat-intel feeds & IP reputation
- Emergency Under Attack Mode
Advanced rate limiting
- Per-endpoint gates — strict on /login
- Valkey-backed fixed-window counters
- Configurable per API / public / sensitive routes
API shield & zero-trust API
- SSRF, BOLA/IDOR, GraphQL abuse, JWT validation
- Schema validation, shadow-API discovery
- WebSocket & hotlink protection, credential checks
Data & supply chain
- India DLP — Aadhaar / PAN / phone masking in memory
- CSP injection & client-side script firewall (Magecart)
- Insecure JS library replacement
- Active deception — honeytokens & tarpits
Status: production edge security. Reverse-proxy edge, WAF, bot, DDoS, API shield, DLP, deception and supply-chain modules are live and test-covered. Quantum-safe TLS termination (X25519MLKEM768) is reported today; real termination is deferred.