Security that understands
your business logic

Application-layer protection that validates requests against contracts, not just patterns. Stop attacks that WAFs can't see.

Get Started Try Live Demo Read the Docs

Node.js Python Java

Open Source Core Apache 2.0 License < 1ms latency

The Problem

Traditional WAFs and rate limiters protect against known attack patterns. But they can't detect requests that are technically valid but business-absurd: an order with negative quantities, a transfer exceeding account balance, a booking for impossible dates.

The Solution

ContractShield validates requests against your business contracts. Define what your API accepts using JSON Schema for structure and CEL for invariants. Block attacks at the application layer, where you understand the context.

One solution for your entire stack

Native integrations for Node.js, Python, and Java. Same contract-first approach across all platforms.

app.js

import { ContractShield } from '@cshield/core';
import { expressAdapter } from '@cshield/express';

const shield = new ContractShield({
  contracts: {
    'POST /api/orders': {
      schema: {
        type: 'object',
        properties: {
          items: { type: 'array', minItems: 1 },
          total: { type: 'number', minimum: 0 }
        },
        required: ['items', 'total']
      },
      invariants: [
        'request.body.total == sum(request.body.items.map(i, i.price * i.qty))'
      ]
    }
  }
});

app.use(expressAdapter(shield));

from fastapi import FastAPI
from contractshield.fastapi import ContractShieldMiddleware

app = FastAPI()

app.add_middleware(
    ContractShieldMiddleware,
    openapi_path="./openapi.yaml",
    enable_vulnerability_scan=True
)

@app.post("/api/orders")
async def create_order(order: OrderRequest):
    # ContractShield has already validated
    return {"status": "success"}

@RestController
@RequestMapping("/api")
public class OrderController {

    @PostMapping("/orders")
    @ValidateContract(schema = "schemas/order.json")
    @CELExpression(
        value = "data.total > 0",
        message = "Total must be positive"
    )
    public ResponseEntity<OrderResponse> createOrder(
            @RequestBody OrderRequest request) {
        return ResponseEntity.ok(new OrderResponse("success"));
    }
}

Node.js

npm install @cshield/core

Python

pip install contractshield

Java

dev.contractshield

Everything you need for application security

Two layers of protection: vulnerability checks for known attack patterns, and contract enforcement for your business logic.

Contract-First Security

Define what your API accepts using JSON Schema and CEL invariants. Reject requests that are technically valid but business-absurd.

Pro

Learning Mode

Observe API traffic and auto-generate security rules. The fastest way to bootstrap protection for existing APIs.

Vulnerability Protection

Built-in detection for prototype pollution, path traversal, SSRF, and other application-layer attacks.

Pro

Sink-aware RASP

Monitor dangerous operations like SQL queries and file access. Block attacks that bypass input validation.

Multi-Platform Support

Native adapters for Node.js (Express, Fastify), Python (FastAPI, Flask), and Java (Spring Boot). One solution for your entire stack.

Sub-millisecond Latency

Optimized for production. Schema caching, compiled CEL expressions, and zero-allocation hot paths.

Ready to protect your API?

Start with the open source core. Upgrade to Pro for Learning Mode, sink-aware RASP, and premium support.

View Pricing Star on GitHub

Security that understands your business logic