Shibuya
A firewall that sits in front of your website and inspects every request for common attacks — SQL injection, cross-site scripting and the like — before it ever reaches your app.
🔗 Visit Shibuya
Description
Most websites get probed constantly for known attack patterns: someone trying to sneak a SQL command into a search box, or a script tag into a comment field. A Web Application Firewall (WAF) is the layer that catches those attempts before they hit your actual application code, and Shibuya is a WAF you run yourself, as a reverse proxy in front of whatever you're protecting.
Shibuya is a Rust-based WAF built on Cloudflare's Pingora proxy framework, running the OWASP Core Rule Set alongside custom rules to detect SQL injection, XSS, path traversal, command injection, server-side template injection, Log4Shell-style attacks and NoSQL injection. It supports hot-reloading rules without restarting the proxy, Redis-backed distributed rate limiting for multi-instance deployments, inspection of multipart form data and JSON request bodies, and a dashboard for monitoring traffic. Benchmarked latency is sub-millisecond (p99 of 1.60ms), which matters if you're adding it in front of a latency-sensitive service. It's source-available under the PolyForm Noncommercial license — free to self-host for non-commercial use, but not simply MIT/Apache-permissive for commercial deployment. At one GitHub star, it's genuinely early-stage, but the project is unusually upfront about its own limits: the README explicitly lists what it doesn't do yet, including response inspection, XML/SOAP support, request-body DoS protections, and an acknowledged broken ML classifier component.
💬 Our review
The short version: if you want a fast, self-hosted WAF for a personal or non-commercial project and you're comfortable running MVP-stage security software, Shibuya covers the standard attack patterns with honest documentation about what it can't do yet.
Against established options like ModSecurity or a managed service like Cloudflare WAF, Shibuya's real edge is raw performance (sub-2ms p99 latency in Rust) and full self-hosted control — but the licensing already rules it out for commercial use without a separate arrangement, and at one star it has effectively zero field-tested track record. What actually stands out here isn't the feature list, it's the candor: most early security projects oversell readiness, and Shibuya's README instead flags its own broken ML classifier and missing response inspection up front. That's a genuinely good sign about the maintainer's judgment, but it doesn't change the fact that this shouldn't be your only line of defense for anything commercial or high-stakes yet — pair it with a managed WAF or treat it as a learning/personal-project tool until it matures past MVP.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Gratuit en usage non-commercial (licence PolyForm Noncommercial 1.0.0) ; usage commercial nécessite un arrangement séparé
Pros
Latence très basse (p99 1.60ms) grâce à Rust + Pingora
Couvre les attaques classiques : injection SQL, XSS, traversal, Log4Shell, NoSQL injection
Rechargement des règles à chaud, rate limiting distribué via Redis
Documentation honnête sur ses propres limites (rare pour un projet aussi jeune)
Cons
Licence non-commerciale seulement — inutilisable tel quel pour un usage pro sans accord
Stade MVP explicitement assumé : pas d'inspection des réponses, classifieur ML cassé
Un seul contributeur visible, 1 étoile GitHub — aucun retour terrain externe