SafeLine

SafeLine is an open-source, self-hosted web application firewall (WAF) and reverse proxy designed to protect web applications from exploits. It operates by filtering and monitoring HTTP traffic between the internet and the web server, acting as a shield that blocks malicious requests before they reach the backend application. By sitting in front of the web server, it ensures that all incoming traffic is inspected against a set of security policies to determine if the requests are safe or malicious.

The software is deployed as a server-side application that manages traffic based on defined security policies. It is used to prevent unauthorized data exfiltration and to stop common web-based attacks by analyzing incoming requests and blocking those that match known attack patterns or exceed specific traffic thresholds. This setup allows administrators to maintain a layer of separation between their internal application logic and the public internet, reducing the attack surface of the hosted services.

Key features

• Blocking of SQL injection, XSS, RCE, XXE, and SSRF attacks
• IP-based rate limiting to mitigate DoS attacks and brute force attempts
• Anti-bot challenges to distinguish between human users and automated crawlers
• Authentication challenges requiring a password for visitor access
• Dynamic encryption of HTML and JavaScript code during page visits
• Protection against path traversal, CRLF injection, and OS command injection
• Web Access Control List for managing traffic permissions

SafeLine is built for system administrators and security teams who need to secure web infrastructure. It uses a reverse proxy architecture to hide the origin server from direct exposure, ensuring that clients must pass through the WAF before reaching the destination. The system includes different protection levels, such as balance and strict modes, to allow users to adjust the trade-off between detection rates and false positives. This flexibility helps in managing various traffic environments, from low-risk internal tools to high-traffic public websites.

This tool serves as a security layer for self-hosted web services and API infrastructure.