Our WAF and OWASP baseline, explained
Security shouldn't be a project you start after launch. On every Clonext instance, a managed web application firewall and an OWASP-aligned baseline are switched on from the first deploy — here's what that actually includes.
What the WAF blocks
At the edge, Google Cloud Armor screens every request before it reaches your application — a managed policy on Google's global load balancer, so your code never has to be the last line of defence.
- OWASP Top 10 patterns — an enforced guard against the classic injection and cross-site-scripting payloads, with the preconfigured OWASP rule sets evaluating every request.
- Login rate-limiting at the edge and in the application — repeated sign-in attempts are banned before they become a brute-force problem.
- Exemptions engineered per route — payment webhooks and rich editors keep working; nothing gets blocked by accident.
- TLS with Google-managed certificates and HSTS, on your own domain.
A good baseline is the security you get without filing a ticket for it.
OWASP as a floor, not a ceiling
The OWASP standards give us a shared checklist, but a checklist is a starting point. We map each control to something concrete in the core — session handling, output encoding, dependency policy — and verify it as part of the build rather than trusting that a framework did it for us.
Tuned per instance
Because every instance is isolated, we can tune rules to your traffic without worrying about a neighbour. A false positive on your API gets fixed for you, not negotiated across a shared tenancy.
The wider edge around this baseline — the global load balancer, DNSSEC, the identity gate — is covered in The Google edge, explained.
