Untitled topic

Built RhinoWAF for protecting self-hosted services at the application layer.

Handles rate limiting, bot detection, SQL injection/XSS filtering, API abuse prevention.

Not for volumetric network ddos (that needs Cloudflare-scale infrastructure), but for application-level threats in on premise or privacy sensitive environments.

Single Go binary, simple config. Running it on 8 services for months.

Feedback welcome on architecture and where this actually fits vs commercial solutions.