EdgeAegis runs native OWASP CRS before a request reaches your business. Configure multiple internal functions, VPS origins and load-balancer hostnames in one routing file, with separate credentials for each trust boundary.

Real terminal, real HTTP responses

EdgeAegis VM terminal

The isolated VM recording uses curl against two functions and three authenticated HTTPS origins. A SQL injection receives 403 without another origin access; a five-second demonstration ban then expires. The five-second TTL is for this lab, not the production default.

Rules and routing stay separate

rules/config.yml selects native rules, policy and your allowlist. origin/config.yml maps public hostname/path patterns to destinations. secret/credentials.yml holds independent origin keys in your private deployment repository.

npm exec --package=edgeaegis -- edgeaegis init my-firewall
cd my-firewall
npm install

routes:
  - pattern: api.example/shop/*
    origin: function:shop
  - pattern: api.example/orders/*
    origin: https://192.0.2.10
    key: orders-vps
  - pattern: api.example/search/*
    origin: https://lb.example
    key: search-lb

Internal functions stay behind inspection

A configured function: selects origin///index.js. The shared firewall entry point inspects the request before calling the function, then inspects its response. External origins must verify their own selected key.

Measure the boundaries

Complete CRS compilation and execution are checked before rule updates. Unknown semantics fail visibly. Resource bounds and platform limits still apply; upgraded WebSocket payloads are opaque to SecLang and Worker-only counters are local to an engine instance.

Vibe Coding and Agent reports are welcome. Run the relevant tests before submitting code. Sensitive findings need a private report with an affected version, sanitized reproducer, impact and actual verification evidence.

Explore EdgeAegis · README