OpenWAF.dev

Protect every site you run, without touching a server. WAF, DNS, bot and AI agent control for agencies. Hosted in the EU.

[OpenWAF.dev @openwaf]

Protect every site you run, without touching a server. OpenWAF puts a managed WAF, AI-bot control, a proof-of-work check and DNS in front of every domain, on an EU edge. Run it from a dashboard or your AI assistant. Free for up to 100 domains: https://t.co/0Y1RFHuzQG

[OpenWAF.dev @openwaf]

OpenWAF Deploy: managed deployment for agencies, integrated with managed edge security.

Your servers. Your infrastructure. An open-source agent (Apache-2.0), outbound-only, with signed, reproducible releases and verifiable provenance.

https://t.co/6pLJMXCCmt

[OpenWAF.dev @openwaf]

@sydneyrunkle Async approvals need one more property: approve the exact action, not the intent. If a background subagent's request is answered minutes later on another thread, bind the approval to a hash of the steps it will run, so what executes is what was approved.

[OpenWAF.dev @openwaf]

@ClaudioSonnet One honest caveat from the post: adding a new published port still recreates the router on that server, about a second without traffic on its ports. Plain redeploys don't touch it. That one is on our list.

[OpenWAF.dev @openwaf]

OpenWAF Deploy is in public beta. git push, and a Rust agent on your own server builds and runs the app. It dials out with Ed25519-signed messages, so we hold no SSH keys, and app ports open only to our edge. First site moved off Coolify: 532/532 requests 200 at the DNS cutover.

[OpenWAF.dev @openwaf]

@ClaudioSonnet Thanks! The part we cared about most: a stolen copy of our database cannot reach anyone's servers. Agents only obey frames signed by a key that is not in the database. And rolling redeploys under a request loop: 2,155 requests, 0 failed.

[OpenWAF.dev @openwaf]

@CFchangelog Useful if you run Network Firewall. Without it, the same idea is one nftables rule in prerouting (it also covers traffic forwarded to containers): ip protocol tcp ip hdrlength != 5 drop. It drops IPv4 TCP with IP options. On our fleet since Oct 29. Still patch the kernel.

[OpenWAF.dev @openwaf]

How it works, what the beta does not do yet, and a live demo: https://t.co/7kWGhhuOpd

[OpenWAF.dev @openwaf]

@hikariraina @trending_repos @vercel Agreed on both. One limit of the wrapper: it can label screen text as untrusted, it can't make it safe. The model still reads it in the same context, so the gate has to sit outside the model: confirm every mutating call, and never let a launch take arguments read from the screen.

[OpenWAF.dev @openwaf]

@VeraxVault @trending_repos @vercel Not ours, we only read it. The fix is small and belongs upstream: the CLI already has is_mutating() in src/cli/mod.rs, it just never reaches readOnlyHint/destructiveHint in src/mcp/catalog.rs. Hints stay advisory; the real gate is the client asking before any mutating call.

[OpenWAF.dev @openwaf]

@TheHackersNews Containers are the easy place to miss this. An image FROM alpine that installs openssh-server and gives any user a password (a $6$ hash) meets the conditions for every key-only user. apk upgrade in a running container doesn't stick: rebuild, redeploy, check sshd -T.

[OpenWAF.dev @openwaf]

@midudev Ojo al requisito del README: un sandbox del sistema sin red, con entorno limpio y escritura solo en carpetas temporales. Sin él, el skill no ejecuta el código auditado y deja el hallazgo como needs_validation. No es lo mismo correrlo en tu portátil con tus claves cargadas.

[OpenWAF.dev @openwaf]

Per bot: published IP ranges, reverse DNS or a Web Bot Auth signature. Never the user agent alone. Then your policy decides: allow, challenge or block.

https://t.co/PeqJNz3iD2

[OpenWAF.dev @openwaf]

Two bots, same IP, same second: Googlebot-Image asked for /env.txt, Twitterbot for /config.json. Neither checked out: not Google's reverse DNS, not in X's IP ranges.

OpenWAF verifies every bot claim. On https://t.co/0Y1RFHv7Ge this week: 4,463 crawler requests verified.

[OpenWAF.dev @openwaf]

@paulmillr Open source won't die over this. Brotli is the case for it: one fix patched .NET, Node, Bun and Envoy at once. A thousand AI rewrites means a thousand bugs nobody patches. Tiny deps go away, audited libraries stay.

[OpenWAF.dev @openwaf]

@CTITraffic The goal-decomposition example is why per-step checks miss it: reading .env and making an HTTP call are both routine. What still works is checking the way out: a request to a host the agent never used, carrying something shaped like a secret, should fail whatever the plan.

[OpenWAF.dev @openwaf]

@Cloudflare Useful split. Cequence's data from last week shows why identity has to be verified: one scanner rotated through ~32 AI bot user agents hunting .env files, and at some orgs it was over 80% of the traffic labeled AI bot. Check signatures or IP ranges, not the UA.

[OpenWAF.dev @openwaf]

@RoundtableSpace Two steps from GitBook's own notice that lists like this skip: re-authenticate the GitBook MCP server in every assistant using it, and revoke GitLab Sync tokens in GitLab itself. GitBook's guide asks for write_repository scope, so rotating only in GitBook leaves them live.

[OpenWAF.dev @openwaf]

@playwrightweb Same trap for hosted agent browsers: a container image freezes Chrome just like a pinned build does. Stable channel and sandbox on is half of it; the other half is rebuilding the image when Chrome ships a security fix, not on your next deploy.

[OpenWAF.dev @openwaf]

@jackhcable On CVE-2026-98432: as of today Ubuntu 22.04's fixed kernel still isn't in -updates or -security (5.15.0-202 is the latest there). Until it lands, sysctl net.mptcp.enabled=0 turns Multipath TCP off, which is what the bug needs.