Repolode
Submit
chaitin

chaitin/SafeLine

A self-hosted web application firewall and reverse proxy that filters HTTP traffic to block attacks like SQL injection, XSS, and bot floods.

Open-source alternative to:Cloudflare WAFAWS WAFImperva

View on GitHubWebsite
Stars
22,772
Forks
1,552
Open issues
51
Last commit
21 days ago

What is it?

SafeLine is a self-hosted web application firewall (WAF) that sits between your web application and the Internet as a reverse proxy. All HTTP traffic passes through it, so malicious requests can be filtered or blocked before they reach the server.

It targets a broad set of web attacks, including SQL injection, XSS, code and OS command injection, SSRF, XXE, path traversal, and brute-force or HTTP flood attempts. Beyond attack filtering, it provides IP-based rate limiting, a web access control list, anti-bot challenges that let human visitors through while blocking crawlers, and an optional password challenge in front of a site.

SafeLine also offers dynamic protection that encrypts HTML and JavaScript on each visit, and it ships integrations for Ingress-NGINX on Kubernetes and the Kong Gateway, plus an MCP server for AI-assisted management. A commercial PRO edition is also offered.

Key features

  • 01Blocks common web attacks such as SQL injection, XSS, command injection, and SSRF.
  • 02Rate limiting by IP to slow down brute-force attempts and traffic surges.
  • 03Anti-bot challenges that allow human visitors while blocking crawlers.
  • 04Optional password challenge to gate access to a site.
  • 05Dynamic encryption of HTML and JavaScript on each visit.
  • 06Ingress-NGINX and Kong Gateway plugins for Kubernetes and API traffic.

Use cases

  • Protecting a public-facing website or web app from common injection and XSS attacks.
  • Adding rate limiting and bot defense in front of login pages or APIs.
  • Securing Kubernetes ingress traffic with an existing Ingress-NGINX setup.
  • Protecting APIs routed through Kong Gateway.

Topics

#waf#web-security#reverse-proxy#self-hosted#application-security#bot-protection#rate-limiting#api-gateway#appsec#blueteam

FAQ

What is SafeLine?
A self-hosted web application firewall and reverse proxy that filters HTTP traffic to block attacks like SQL injection, XSS, and bot floods. SafeLine is a self-hosted web application firewall (WAF) that sits between your web application and the Internet as a reverse proxy. All HTTP traffic passes through it, so malicious requests can be filtered or blocked before they reach the server.
Is SafeLine free to use? What license does it have?
SafeLine is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is SafeLine still maintained?
Actively maintained. The last commit to SafeLine was on Sep 28, 2026.
What can I use SafeLine for?
Protecting a public-facing website or web app from common injection and XSS attacks. Adding rate limiting and bot defense in front of login pages or APIs. Securing Kubernetes ingress traffic with an existing Ingress-NGINX setup. Protecting APIs routed through Kong Gateway.
Where can I get SafeLine?
The source code and installation instructions are on GitHub: https://github.com/chaitin/SafeLine

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects