ContractShield WAF
Web Application Firewall
Application-layer security that understands your business logic. Protect your APIs in real-time against OWASP Top 10 attacks and beyond.
Features
Two layers of protection: vulnerability checks for known attack patterns, and contract enforcement for your business logic.
OWASP Top 10 Protection
Built-in detection for SQL injection, XSS, SSRF, path traversal, and more.
Contract-First Validation
Define what your API accepts using JSON Schema and CEL invariants. Reject business-absurd requests.
Rate Limiting
Configurable rate limits per endpoint, per user, or per IP. Prevent abuse before it impacts your application.
Prototype Pollution Blocking
Detect and block __proto__, constructor, and prototype pollution attempts at the request level.
SSRF Prevention
Block server-side request forgery attempts by validating URLs against allowlists and detecting internal network access.
Sub-millisecond Latency
Optimized for production. Schema caching, compiled CEL expressions, and zero-allocation hot paths.
Get Started in Minutes
Install ContractShield and protect your API today.
npm install @cshield/core pip install contractshield Maven: dev.contractshield Defense in Depth
DDoS protection, Known signatures, IP reputation
Authentication, Rate limiting, Routing
Contract validation, Vulnerability checks, RASP protection
Receives only validated, safe requests
Ready to protect your API?
Start free with open source. Upgrade to Pro for Learning Mode, sink-aware RASP, and premium support.