Pick your install:
- Node: npm install @arcis/node
- Python: pip install arcis
- Go: go get https://t.co/t5HbZ6NtkX
Same config object. Same attack vectors. Same conformance tests.
https://t.co/6NmRQhGOEg
Detection logs.
Prevention refuses.
Most "security tools" do detection. They tell you what happened.
Inline middleware does prevention. It tells the attacker "no" and
returns 403 before your handler runs.
The difference is where the verdict lands.
Shipped @arcis/mcp 1.0.
Seven prompt-injection payloads fire at an MCP server on every
CI run. The test is the spec. The test passes.
https://t.co/0fTyR4ORjD
YC S26: no.
Saw it coming. Applied anyway because the project is worth it.
Arcis is open-source security middleware in Node, Python, Go.
12k+ downloads, all free, all MIT. Same plan. Same product.
Back to building.
https://t.co/S6KC6VLqXY
Reading the Log4Shell postmortems from 2022 with 2026 eyes:
The recurring sentence is "we found Log4j in production by reading the news."
Inventory beats response. The defense is in your handler, not in the SOC dashboard.
Your XSS filter blocks <script>.
Does it block the same six characters in fullwidth form?
Most pre-2023 detectors do not.
https://t.co/opxq3PIxvE
Agent security has four layers: identity, pre-deploy testing,
observability, defense.
Only the defense layer can refuse a request in flight. The other
three are advisory by structure.
https://t.co/SxSF8TC06H
@ItsWillHenry Arcis. Open-source security middleware for Node, Python, and Go web apps.
One line of code, 30+ attack vectors handled inside the app.
https://t.co/erAA6C1hbU
If you want the full thesis behind Arcis - what it is, what it
does NOT do, and the inside-the-app argument, the launch post is
the cleanest place to start.
5-minute read.
https://t.co/5WUeQ0Gebm
The fix for fullwidth XSS bypasses is three lines per language:
JS: input.normalize
Python: unicodedata.normalize
Go: norm.NFKC.String
Catches: fullwidth, ligatures, math letterlikes.
Skip it and your sanitizer has a permanent backdoor.
2026 reality: every app is now three apps.
A request app. A model app. A tool app.
The WAF protects the request app. Nothing protects the other two.
That's the gap Arcis is in.
Arcis conformance status:
154/154 tests pass across Node + Python + Go
Same input → same verdict in all three SDKs
Drift = failed CI = no release
Cross-SDK parity is the only metric that matters once a tool
ships in multiple languages.
What one `app.use(arcis())` line replaces in a typical Express app:
helmet
express-rate-limit
csurf
sanitize-html
hpp
express-mongo-sanitize
Five fewer libraries to keep updated.
#Cyber_Security#security
The full Arcis install:
npm install @arcis/node
Two lines. Thirty attack vectors at the request boundary.
OWASP Top 10 plus prompt injection, MCP toolcall, deserialization,
and 20 more.
https://t.co/erAA6C1hbU
#cybersecurity#security#appsec#devtools#opensource
@xARx_00@X you might vibe with this, your SOC tells you the attack happened, Arcis just... doesn't let it.
inline middleware, node/py/go.
would love any feedback or advice tbh.
https://t.co/erAA6C1hbU
@overgeared2608 yep, in-app is intentional. per-route is opt-in set defaults globally, override only what needs it. resolved at registration, so no per-request cost.
Arcis ships first-party adapters for:
Express Fastify Hono Next.js Koa
FastAPI Django Litestar Flask
Gin Echo Chi Fiber net/http
One config object. Same defense across all of them.
https://t.co/erAA6C1hbU
Hello world.
Open-sourced Arcis. Security middleware that runs inside your
web app instead of in front of it.
For developers tired of WAFs that block `' OR 1=1` and miss
everything else.
Node, Python, Go.
https://t.co/erAA6C1hbU