Security
Web application firewall, tuned by measurement
Implementedenvironment:DeployedPersonal labSelf-reported · private sourcesite-waf
Claim
The site runs ModSecurity with the OWASP Core Rule Set at paranoia level 3, compiled from signature-verified sources, behind the rate limits. It was tuned against the full end-to-end suite, real browsers, crawlers and API clients (zero false positives) and tested with an attack battery and GoTestWAF; a flood is refused before any rule runs.
Status
- implemented
- Capped at Implemented: the code, tests and records are private, so this is self-reported and cannot be verified publicly.
- deployed
- Running in a real, reachable environment I operate.
- personal lab
- My own projects. Public repositories carry CI-verified evidence; private ones are self-reported.
Source
A personal project whose repository is private and cannot be published. So this claim is self-reported: it stops at Implemented and links to no artifacts.
Limitations
- Tested by me, with public tools and my own attack battery; no external penetration test.
- It cannot stop a distributed flood large enough to exhaust the host.
- Source: private repository. The block page and response headers can be checked from any browser.