SafeLine is a self-hosted web application firewall and reverse proxy, written in Go and licensed under GPL-3.0, that filters, monitors, and blocks malicious HTTP/S traffic before it reaches a web application — built for developers, AppSec engineers, and blue teams who want to run edge protection on their own infrastructure.

What it is

SafeLine places a shield between a web application and the internet. By deploying a WAF in front of a web application, clients pass through the WAF before reaching the server, and traffic is filtered against a set of policies that determine what is malicious and what is safe. It is a reverse-proxy intermediary in the same structural position as a proxy server that hides a client's identity, except that it protects the server from a potentially malicious client. The repository is classified under Developer Tools / API Development & Testing, carries the GPL-3.0 licence, and lists 22,603 stars, 1,532 forks, and 69 open issues.

The concrete problem it addresses is the class of attacks aimed at web applications: SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, bruteforce, http-flood, and bot abuse. Repository topics include appsec, application-security, blueteam, firewall, captcha, cve, cybersecurity, hackers, and http-flood. The README positions SafeLine against ModSecurity Level 1 and CloudFlare Free in a detection and false-positive evaluation, so it occupies the slot a self-managed ModSecurity deployment would otherwise fill.

Key capabilities

• Block Web Attacks covers SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, and backdoor.
• Rate Limiting throttles traffic that exceeds defined limits to defend against DoS attacks, bruteforce attempts, and traffic surges; IP-based rate limiting is listed as a core capability.
• Anti-Bot Challenge allows human users through while crawlers and bots are blocked.
• Authentication Challenge requires visitors to enter a password, otherwise they are blocked.
• Dynamic Protection encrypts HTML and JavaScript code in the web server dynamically each time a visitor loads it.
• Web Access Control List is listed as a core capability alongside defenses for web attacks and proactive bot abuse defense.
• HTTP flood and bot abuse are named explicitly among the attacks the project handles.

Who uses it and how

• AppSec and blue-team engineers self-host it as the reverse proxy in front of web applications; the README answers "Is SafeLine Production-Ready?" with yes.
• API owners are addressed by the api-gateway and application-security topics.
• Teams evaluating the project before deploying can use the hosted live demo at https://demo.waf.chaitin.com:9443/.
• Operators facing sustained abuse use rate limiting to throttle bruteforce and HTTP-flood traffic.
• Users in mainland China are warned that installing the international version may prevent connection to the cloud service, and are directed to the Chinese-language installation documentation instead.

Getting started

The README does not include install commands; it points to the Install Guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy, with application configuration documented at https://docs.waf.chaitin.com/en/GetStarted/AddApplication. A live demo is available at https://demo.waf.chaitin.com:9443/.

How it compares

The README's evaluation over 33,669 samples reports 69.74% detection and 17.58% false positive for ModSecurity Level 1, 10.70% detection and 0.07% false positive for CloudFlare Free, 71.65% detection and 0.07% false positive for SafeLine in its Balance configuration, and 76.17% detection with 0.22% false positive in Strict. Accuracy on the same run is 82.20%, 98.40%, 99.45%, and 99.38% respectively. These are project-published figures rather than independent measurements.

When to use it — and when not to

Self-hosting means operating a reverse proxy in front of every protected application, and the README leaves installation steps to the external install guide rather than documenting them in the repository. The README is also truncated mid-sentence at its production-readiness answer, and the GPL-3.0 licence constrains redistribution inside closed products. Anyone who wants a fully managed edge service without running a proxy should not pick it, and mainland China users should follow the Chinese install documentation rather than the international build.