Built RhinoWAF for protecting self-hosted services at the application layer. Handles rate limiting, bot detection, SQL injection/XSS filtering, API abuse preve

Built RhinoWAF for protecting self-hosted services at the application layer. Handles rate limiting, bot detection, SQL injection/XSS filtering, API abuse prevention. Not for volumetric network ddos (that needs Cloudflare-scale infrastructure), but for application-level threats in on premise or privacy sensitive environments. Single Go binary, simple config. Running it on 8 services for months. Feedback welcome on architecture and where this actually fits vs commercial solutions.