A simple framework on when WAFs work and when they may not
boringappsec.substack.com