arcis

Security middleware for every backend.

[arcis @getarcis]

Pick your install:

- Node: npm install @arcis/node
- Python: pip install arcis
- Go: go get https://t.co/t5HbZ6NtkX

Same config object. Same attack vectors. Same conformance tests.

https://t.co/6NmRQhGOEg

[arcis @getarcis]

Detection logs.
Prevention refuses.

Most "security tools" do detection. They tell you what happened.

Inline middleware does prevention. It tells the attacker "no" and
returns 403 before your handler runs.

The difference is where the verdict lands.

[arcis @getarcis]

Shipped @arcis/mcp 1.0.

Seven prompt-injection payloads fire at an MCP server on every
CI run. The test is the spec. The test passes.

https://t.co/0fTyR4ORjD

[arcis @getarcis]

YC S26: no.

Saw it coming. Applied anyway because the project is worth it.

Arcis is open-source security middleware in Node, Python, Go.
12k+ downloads, all free, all MIT. Same plan. Same product.

Back to building.

https://t.co/S6KC6VLqXY

[arcis @getarcis]

Reading the Log4Shell postmortems from 2022 with 2026 eyes:

The recurring sentence is "we found Log4j in production by reading the news."

Inventory beats response. The defense is in your handler, not in the SOC dashboard.

[arcis @getarcis]

Your XSS filter blocks <script>.

Does it block the same six characters in fullwidth form?

Most pre-2023 detectors do not.

https://t.co/opxq3PIxvE

[arcis @getarcis]

Agent security has four layers: identity, pre-deploy testing,
observability, defense.

Only the defense layer can refuse a request in flight. The other
three are advisory by structure.

https://t.co/SxSF8TC06H

[arcis @getarcis]

The WAF and the application see the same HTTP request differently.

The attacker only needs to live in the seam.

https://t.co/dpBCCWWwha

[arcis @getarcis]

@hthieblot Refuse

[arcis @getarcis]

@ItsWillHenry Arcis. Open-source security middleware for Node, Python, and Go web apps.

One line of code, 30+ attack vectors handled inside the app.

https://t.co/erAA6C1hbU

[arcis @getarcis]

If you want the full thesis behind Arcis - what it is, what it
does NOT do, and the inside-the-app argument, the launch post is
the cleanest place to start.

5-minute read.

https://t.co/5WUeQ0Gebm

[arcis @getarcis]

The fix for fullwidth XSS bypasses is three lines per language:

JS: input.normalize
Python: unicodedata.normalize
Go: norm.NFKC.String

Catches: fullwidth, ligatures, math letterlikes.
Skip it and your sanitizer has a permanent backdoor.

[arcis @getarcis]

2026 reality: every app is now three apps.

A request app. A model app. A tool app.

The WAF protects the request app. Nothing protects the other two.
That's the gap Arcis is in.

[arcis @getarcis]

Arcis conformance status:

154/154 tests pass across Node + Python + Go
Same input → same verdict in all three SDKs
Drift = failed CI = no release

Cross-SDK parity is the only metric that matters once a tool
ships in multiple languages.

[arcis @getarcis]

What one `app.use(arcis())` line replaces in a typical Express app:

helmet
express-rate-limit
csurf
sanitize-html
hpp
express-mongo-sanitize

Five fewer libraries to keep updated.

#Cyber_Security #security

[arcis @getarcis]

The full Arcis install:
npm install @arcis/node

Two lines. Thirty attack vectors at the request boundary.
OWASP Top 10 plus prompt injection, MCP toolcall, deserialization,
and 20 more.

https://t.co/erAA6C1hbU

#cybersecurity #security #appsec #devtools #opensource

[arcis @getarcis]

@xARx_00 @X you might vibe with this, your SOC tells you the attack happened, Arcis just... doesn't let it.
inline middleware, node/py/go.

would love any feedback or advice tbh.

https://t.co/erAA6C1hbU

[arcis @getarcis]

@overgeared2608 yep, in-app is intentional. per-route is opt-in set defaults globally, override only what needs it. resolved at registration, so no per-request cost.

[arcis @getarcis]

Arcis ships first-party adapters for:

Express  Fastify  Hono  Next.js  Koa
FastAPI  Django  Litestar  Flask
Gin  Echo  Chi  Fiber  net/http

One config object. Same defense across all of them.

https://t.co/erAA6C1hbU

[arcis @getarcis]

Hello world.

Open-sourced Arcis. Security middleware that runs inside your
web app instead of in front of it.

For developers tired of WAFs that block `' OR 1=1` and miss
everything else.

Node, Python, Go.
https://t.co/erAA6C1hbU