SecKav
Product · Edge Security

WAF & Edge Security

A Cloudflare-style edge that sits in front of your origin: WAF (SQLi/XSS/RCE/LFI), Bot Management, Layer-7 DDoS, and India-specific DLP (Aadhaar/PAN masking) — all configured from the dashboard and enforced before traffic reaches you.

Get protected (no code)

  1. 1
    Add your domain
    In the dashboard, Coverage → Add domain. Enter your hostname and origin.
  2. 2
    Point DNS at the edge
    Create the CNAME SecKav shows you (e.g. edge.seckav.tech). SecKav verifies the wiring.
  3. 3
    Choose an enforcement mode
    Start in monitor (log-only), review Security Events, then flip to block per feature when you're confident.
Every feature has three modes — off / monitor / block — so you roll out enforcement gradually and never break production on day one.

Web Application Firewall

Managed rules cover OWASP-class attacks with an encoding-aware normalizer (double-encoding, homoglyph, full-width and overlong-UTF-8 evasion are folded before matching). Add your own rules with fields, operators, and boolean combinators.

json
// Custom rule (dashboard → WAF → Custom rules)
{
  "match": "any",
  "conditions": [
    { "field": "path", "op": "starts_with", "value": "/admin" },
    { "field": "header:cf-connecting-ip", "op": "not_in_cidr", "value": "10.0.0.0/8" }
  ],
  "action": "block"
}

Bot Management

Requests are scored 0–100 from TLS/HTTP fingerprints and behavior. Actions are per-tenant: block · challenge · tarpit · fake-data. A SHA-256 proof-of-work interstitial replaces trivially-bypassable arithmetic challenges.

Layer-7 DDoS

An O(1) penalty box bans abusive IPs at the edge (shared across replicas via Valkey), with an "Under Attack" emergency mode you can toggle instantly.

India DLP

Outbound responses are scanned and PII is masked in-flight — Aadhaar (Verhoeff-validated), PAN, GSTIN, bank/IFSC, UPI, phone, email — so a leaky endpoint can't exfiltrate personal data. This is the same masker the SDK runs client-side.

bash
# Verify masking on a test endpoint
curl -s https://app.acme.com/profile | grep -c '[0-9]\{12\}'   # → 0

Automate via API

Everything the dashboard does is an API. Toggle WAF, read analytics, or export evidence with your secret key.

bash
curl -X PATCH https://api.seckav.tech/v1/config/tenant \
  -H "Authorization: Bearer sk_live_…" -H "content-type: application/json" \
  -d '{ "settings": { "waf": { "mode": "block", "sensitivity": "high" } } }'
AI Security →
Protect AI agents and APIs on top of the edge.