A control plane, governed rule management, compliance evidence and SIEM export — layered on the open core through its extension seams, without forking it. Self-hosted, off the request path.
Three things change when you move from a standalone WAF to a governed deployment across many nodes.
The core protects one node; the enterprise data-path modules coordinate across the whole cluster — one rate-limit budget, shared reputation, managed certificates.
A control plane collects every node's telemetry, shows what's blocked and why, alerts on attack signatures, and manages rules with per-node convergence.
RBAC and SSO, a signed tamper-evident audit log, on-demand SOC2/PCI evidence, and a SIEM feed — the paperwork a security program needs.
Enterprise detection modules plug into the core's seams, survive reloads, and act across the whole cluster — never a fork.
One token-bucket budget shared across every node via Redis, accounted atomically server-side. No node over-allows.
Score client IPs from your blocklists; a single-writer feed keeps the shared, self-expiring reputation fresh across the fleet.
Hitless certificate issuance and rotation (TLS-ALPN-01 or DNS-01 wildcards), coordinated across nodes so one issues for the cluster.
A maintained pack of high-signal content — Log4Shell, Spring4Shell, cloud-metadata SSRF, CISA-KEV CVEs — on top of the CRS engine.
Validate every GraphQL and gRPC operation against your app's real schema; a field the real client never sends is a probing signal.
Extend detection with your own WASM modules, gated by a detached signature. A plugin that fails verification never loads.
A separate service, off the request path, that turns every node's telemetry into one operational picture.
Optionally capture the complete denied request — headers, cookies and body — off the data path, so the drill-down shows exactly what was blocked. Raw by default with node-side redaction, short retention, RBAC-gated and audited on every view.
Rules over the decision stream fire when a pattern crosses a threshold (a per-IP or per-rule block burst), with cooldowns, and push to a webhook.
Events and alerts stream in over SSE — the console updates the moment a node reports, without polling latency or a page reload.
Who can do what, a record that can't be quietly altered, and the reports your auditors ask for.
Viewer / operator / admin roles, local accounts, and OpenID Connect single sign-on behind HttpOnly session cookies.
Every action hash-chained and Ed25519-signed — tamper-evident, and verifiable on demand from the dashboard.
Generate a signed SOC2 / PCI evidence bundle for any period: access control, audit integrity, WAF effectiveness, incidents.
Push denied verdicts, audit records and alerts to your SIEM as versioned ECS-like NDJSON — at-least-once, with visible lag.
Helm charts, a first-class operator, and GitOps examples — a WAF per workload, not a rewrite of the data path. Images stay in your registry; nothing is ever pushed to a public one.
One chart puts a hardened WAF in front of a workload; another runs the control plane with bundled or managed Postgres. Everything is a value — modules, TLS, rate limits, capture.
A namespaced CRD (waf.io/v1alpha1): declare a WafProxy and the operator renders and owns the ConfigMap, Deployment and Service. Delete the CR and it cleans up.
Ready-made Argo/Flux, Ingress, Gateway API and cert-manager examples — drop the WAF into the traffic path you already run.
Non-root, read-only rootfs, dropped capabilities; on SIGTERM readiness flips so Kubernetes drains in-flight requests before the pod exits.
The properties that matter when you put a vendor in front of your traffic.
The control plane never sits between clients and your backend. It reads telemetry — it cannot add latency or fail a request.
Every capability plugs into the core's typed extension seams through the builder. The open core is used unmodified, by version.
The same memory-safe, dependency-light foundation as the core — no C libraries dragged into the trust boundary.
Runs on your infrastructure — your Postgres, your Redis, your network. Nothing phones home; your traffic stays with you.
The enterprise tier is commercial, source-available to customers under BSL 1.1. Tell us about your deployment and we'll get you set up.
0x00spor3@gmail.com