Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances

Some feedback (edited to add stuff twice):

- The pricing is confusing. The front page shows me how to install it and run but then another page mentions a free trial? Is that's what I'm doing when I install via apt-get or run via docker?

- What's Wallarm Cloud? It appears to me Wallarm is an nginx module that "protects" stuff, somehow, and for some (maybe all) things it sends them to the Wallarm cloud for analysis. What is the Wallarm Cloud and how does that protect all of my data that it's receiving? What if it's receiving HIPPA data? Is it stored / cached and if so for how long?

- When attempting to register I think it's best to provide a verify option for the password.

- When attempting to register I keep getting errors stating my password is too simple. Even after 50 characters. I assume this is doing a check for symbols or something but allowing any character and then me putting in 50 characters I think it's safe to say it's no longer "too simple"

- You're using CORS but it's a subdomain; you don't need to do anything with CORS at all unless you really want to (but who wants to preflight every single request if you don't have to?). Just set the document.domain to the same domain and you're done.

- I think you can make your registration services flow a little better. Since it makes a request to get a token from the backend and it provides nothing with the request (minus the session id cookie) then that means you're managing session state on the backend so why are you also managing state on the front end? I get the idea behind the token but you have a token and a session id and you're using token more like a session id as it doesn't appear to change when I make calls to it.

- Why do I have a "permissions":["admin"] in my profile? :)

- Clicking on "Profile" takes me to a profile page, it downloads all of the resources and makes REST calls, and then it redirects back to active. Why not do this server-side so it's immediate and less bandwidth intensive? Alternatively if I haven't activated and I entered the wrong email address or other information now I can't update it at all. I have to create a new account. I'd suggest letting profile information be updated.

- Seems too black-box-y to me. I'd like to see something more to the point. Then again I'm an engineer but typically for products like this I've found you need at least some engineer buy-in to sell it to a company.

As I like to say, "Give someone a ghoti, he can speak English for a day, tell them how to ghoti, and they can speak English for a lifetime".

            if (c.get().length  256) C.isValid = !1, c.hasErrors = !0, c.errors = [{
            message: "Password too long" 
        }];
        else if (/^[a-zA-Z0-9`~!@#\$%^&*()_=+\[\]{};:'",.\/? -]*$/.test(c.get())) {
            var e = 0;
            /[a-z]/.test(c.get()) && (e += 1), /[A-Z]/.test(c.get()) && (e += 1), /[0-9]/.test(c.get()) && (e += 1), /[`~!@#\$%^&*()_=+\[\]{};:'",.\/? -]/.test(c.get()) && (e += 2), 3 > e ? (C.isValid = !1, c.hasErrors = !0, c.errors = [{
                message: "Password too simple"
            }]) : (c.hasErrors = !1, c.errors.length = 0)
        } else C.isValid = !1, c.hasErrors = !0, c.errors = [{
            message: "Invalid symbols in password" 
        }]