In-house WAF

A Pingora, Coraza and Nginx Ingress WAF that improved bot fingerprinting accuracy by 48%.

The problem

Commercial WAFs couldn't express the custom bot scoring and challenge logic a payments platform with 500M+ users needs at its edge.

What I built

  • A rule engine on Pingora and Coraza behind Nginx Ingress, containerised and rolled out through CI/CD
  • Custom bot scoring, rate limiting, mTLS enforcement and challenge flows integrated with the CDN
  • Rule precedence tuned for throughput at peak load without breaking latency SLAs

The result

48% better bot fingerprinting accuracy, millions of requests a day, and the CDN hardened against layer-7 attacks.