Baffle WAF

Product Positioning

Tagline options:

"Baffle bots. Calm traffic." (playing on both meanings: confuse + quiet) "Confuse bots. Calm infrastructure." "Bewilder bots, silence the chaos"

Target market:

Solo devs/bootstrapped startups (can't afford $249/mo Wafris/Cloudflare) Privacy-conscious/regulated orgs (data sovereignty requirements) Self-hosters (infrastructure control enthusiasts) Cost-sensitive scale-ups (outgrowing free tiers)

Business Model (Sidekiq-style)

Free (fully functional):

Ruby/Rack edge agent (2-5ms response time) Local SQLite rules IP blocking, rate limiting, geoblocking Manual rule management Community support

Pro ($99-149/mo):

Go edge agent (performance upgrade) SSO / multi-team Centralized hub with traffic analytics Automated rule generation Adaptive sampling (manual 0-100% toggle for hub load management) IP reputation feeds Priority support

Key Technical Decisions

Traffic categories:

Blocked - Matched deny rule Allowed - Matched allow rule (fast-path for whitelisted IPs/APIs) Unmatched - No rules, passed through

OWASP approach:

Don't try to compete with ModSecurity's full CRS Focus on network-layer threats (bots, rate limiting, IP reputation) Map to OWASP Top 10 where applicable (A05, A07, partial A01/A03) Position as complementary to app-layer security

Killer Feature: Performance Visibility

Always-on category timing:

Track latency by rule type (IP checks, rate limits, regex, etc.) Show real-time impact in dashboard Let users add rules and immediately see performance cost "The only WAF that shows you exactly what your rules cost"

Why this matters:

No other WAF does this well Solves "why is my site slow?" blame game Empowers users to make informed tradeoffs Natural deterrent against kitchen-sink rule sets

Implementation:

Start with category-level timing (always on, minimal overhead) Users can experiment: add rule → watch latency → remove if too expensive Can add detailed per-rule profiling later if needed

Terminology Settled

Rule pruning - removing inactive rules for performance Violation/pattern match - when traffic triggers a rule Adaptive sampling - hub telling edges to reduce telemetry load

Architecture Clarity

Self-hosted only (no SaaS hosting from you):

Edge agents do forward auth with local SQLite Push telemetry to hub every 10 seconds Hub analyzes and pushes rules back Max 20-second gap between violation and rule deployment