[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3h02jpmvb7x7t":3},{"code":4,"message":5,"data":6,"timestamp":65},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":30,"summary_md":31,"topic":32,"github_topics":35,"license":55,"homepage":56,"updated_at":57,"history":58},"chaitin\u002FSafeLine",5,"SafeLine is a self-hosted WAF(Web Application Firewall) \u002F reverse proxy to protect your web apps from attacks and exploits.","Go",22941,1571,15,1291,[16,22,26],{"id":17,"title":18,"points":19,"comments":20,"posted_at":21},46205060,"SafeLine – a self-hosted WAF to protect your web apps from attacks and exploits",2,0,"2025-12-09",{"id":23,"title":24,"points":19,"comments":20,"posted_at":25},44178275,"I built a WAF in Go with much higher detection rate than CF (Free)","2025-06-04",{"id":27,"title":28,"points":19,"comments":20,"posted_at":29},44103715,"Has Anyone Tried Safeline WAF? Thoughts and Experiences?","2025-05-27","A self-hosted reverse-proxy WAF that blocks SQLi, XSS and bot traffic for teams that cannot use a cloud firewall.","## The problem\n\nPutting a web app on the internet means someone will probe it within hours. Managed options like Cloudflare's free tier are easy but route all traffic through a third party and detect very little on their own; self-hosted rule engines like ModSecurity need you to tune rule sets and accept a steady stream of false positives. SafeLine targets teams that want traffic inspection on their own infrastructure without becoming WAF operators.\n\n## What's different\n\nIt is a Go reverse proxy with a management UI, not a rule-file bundle you bolt onto nginx. Detection is built in, and the README's own evaluation table claims roughly 76% detection at strict mode versus about 70% for ModSecurity level 1, with false positives around 0.2% instead of ModSecurity's ~17.6% and Cloudflare Free's ~10.7% detection. Those are vendor-published numbers on an unnamed 33,669-sample set, so treat them as a starting point, not proof. Beyond signatures, it adds anti-bot challenges, a password gate, per-IP rate limiting, and dynamic HTML\u002FJS encryption that re-obfuscates pages per visit. Plugins exist for Ingress-NGINX and Kong, plus an MCP server for AI-assisted management.\n\n## Who it's for\n\nSmall and mid-size teams running a handful of web apps, especially in environments where sending traffic through a US cloud vendor is awkward or non-compliant, and where nobody wants to maintain CRS rules. It fits homelabs and self-hosted setups too. Look elsewhere if you need deep custom rule authoring, if you already have a hardened ModSecurity\u002FCRS pipeline you understand, or if you operate at a scale where a single reverse proxy is a bottleneck and you need a distributed edge.\n\n## Cost of adoption\n\nYou need a host to run the proxy and the management console, plus the discipline to put it in front of every app and keep TLS certificates straight. The README is thin on system requirements, architecture and upgrade paths; the linked install and configuration docs carry that weight, so read them before committing. The license is GPL-3.0, which matters if you plan to embed or redistribute it. A paid PRO edition exists, and the CN\u002Finternational install split is a real footgun for mainland users per the README warning.\n\n## Verdict\n\nSafeLine is not a new project riding a spike: created in April 2023, it has accumulated roughly 22.9k stars and sits at #8 on the weekly Go board with +167 stars in a week, while daily gains are only about 15. That profile looks like steady, long-term pull rather than a launch surge. The install base claims (700,000+ installs, 2M sites) are self-reported, but the project's age, ecosystem plugins and board history are consistent with something people actually run. If you want a WAF you can stand up in an afternoon and tune from a UI, this is a reasonable default to try; verify its detection against your own traffic before trusting the comparison table.",{"slug":33,"name":34},"security","Security & Privacy",[36,37,38,39,40,41,42,43,44,45,46,33,47,48,49,50,51,52,53,54],"api-gateway","application-security","appsec","blueteam","bruteforce","captcha","cve","cybersecurity","firewall","hackers","http-flood","self-hosted","sql-injection","vulnerability","waf","web-application-firewall","web-security","websecurity","xss","GPL-3.0","https:\u002F\u002Fly.cyberserval.tech\u002Fd4HFBvC","2026-10-25T00:06:15Z",[59,63],{"date":60,"stars":61,"stars_gained":62},"2026-10-24",22938,16,{"date":64,"stars":11,"stars_gained":13},"2026-10-25",1792901752]