openappsec/openappsec

Health v2 · maintenance only

Adoption not part of the score

1689 stars · 133 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

open-appsec is an open-source machine learning security engine that provides preemptive web application and API threat protection against OWASP-Top-10 and zero-day attacks. It deploys as an add-on to Linux, Docker, or Kubernetes environments on NGINX, Kong, APISIX, or Envoy, using supervised and unsupervised ML models to score and block malicious HTTP requests.

Use cases

• protect web applications from OWASP Top 10 attacks
• prevent zero-day API attacks without signature updates
• add a machine learning WAF to NGINX or Kong
• secure Kubernetes ingress traffic
• block malicious HTTP requests automatically based on learned traffic patterns
• monitor and test web app security in monitor-only mode

When to choose

• you need a modern ML-based WAF integrated into NGINX, Kong, APISIX, or Envoy
• you want preemptive zero-day protection without maintaining signature rules
• you run Linux, Docker, or Kubernetes and want declarative or Kubernetes CRD-based security configuration
• you prefer an open-source alternative to commercial WAFs

When to avoid

• you need a network-layer firewall or DDoS mitigation rather than HTTP-layer protection
• you cannot rely on downloading the advanced production model from the vendor portal
• your stack is not NGINX, Kong, APISIX, or Envoy based
• you need a fully offline solution with no external model updates

Facets

library · maturity active

security machine-learning rate-limiting middleware http-server security web-development apis machine-learning self-hosted waf api-security owasp-top-ten zero-day-protection threat-prevention kong envoy apisix devsecops appsec devops linux docker kubernetes nginx

Member repositories

For agents

markdown · JSON · MCP: product_card(name="openappsec/openappsec")