chaitin/SafeLine

The problem

Putting a web app on the internet means someone will probe it within hours. Managed options like Cloudflare's free tier are easy but route all traffic through a third party and detect very little on their own; self-hosted rule engines like ModSecurity need you to tune rule sets and accept a steady stream of false positives. SafeLine targets teams that want traffic inspection on their own infrastructure without becoming WAF operators.

What's different

It is a Go reverse proxy with a management UI, not a rule-file bundle you bolt onto nginx. Detection is built in, and the README's own evaluation table claims roughly 76% detection at strict mode versus about 70% for ModSecurity level 1, with false positives around 0.2% instead of ModSecurity's ~17.6% and Cloudflare Free's ~10.7% detection. Those are vendor-published numbers on an unnamed 33,669-sample set, so treat them as a starting point, not proof. Beyond signatures, it adds anti-bot challenges, a password gate, per-IP rate limiting, and dynamic HTML/JS encryption that re-obfuscates pages per visit. Plugins exist for Ingress-NGINX and Kong, plus an MCP server for AI-assisted management.

Who it's for

Small and mid-size teams running a handful of web apps, especially in environments where sending traffic through a US cloud vendor is awkward or non-compliant, and where nobody wants to maintain CRS rules. It fits homelabs and self-hosted setups too. Look elsewhere if you need deep custom rule authoring, if you already have a hardened ModSecurity/CRS pipeline you understand, or if you operate at a scale where a single reverse proxy is a bottleneck and you need a distributed edge.

Cost of adoption

You need a host to run the proxy and the management console, plus the discipline to put it in front of every app and keep TLS certificates straight. The README is thin on system requirements, architecture and upgrade paths; the linked install and configuration docs carry that weight, so read them before committing. The license is GPL-3.0, which matters if you plan to embed or redistribute it. A paid PRO edition exists, and the CN/international install split is a real footgun for mainland users per the README warning.

Verdict

SafeLine is not a new project riding a spike: created in April 2023, it has accumulated roughly 22.9k stars and sits at #8 on the weekly Go board with +167 stars in a week, while daily gains are only about 15. That profile looks like steady, long-term pull rather than a launch surge. The install base claims (700,000+ installs, 2M sites) are self-reported, but the project's age, ecosystem plugins and board history are consistent with something people actually run. If you want a WAF you can stand up in an afternoon and tune from a UI, this is a reasonable default to try; verify its detection against your own traffic before trusting the comparison table.