Tools/chaitin/SafeLine

SafeLine

No description available.

23.2k ★+67/wkgrowthGoGNU General Public License v3.0 →trending

View on GitHub →Compare in Network Security →Homepage →

Replaces:Cloudflare WAF

See how it compares →

The Lens

By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.

Updated Oct 2026

SafeLine is a self-hosted web application firewall: a reverse proxy that sits in front of your sites and blocks SQL injection, XSS, command injection, bots and HTTP floods before they reach your app. Chaitin Tech builds it, now selling it internationally as CyberServal, and the Personal edition is free forever for up to 10 apps.

Setup is a root install script on a Linux box with Docker, then you add sites in a web console. The free and Lite editions run single-threaded, rated at about 800 requests per second. Fully open alternatives: Coraza with the OWASP Core Rule Set, or BunkerWeb.

Pricing is public. Lite is $10/month or $100/year for 20 apps, geo-blocking and log export. Pro is $100/month or $1,000/year for unlimited apps, full multi-core performance, multiple admin users and load balancing, with a separate license per node. Solo: free. Small teams: free, or Lite past 10 sites. Larger teams: Pro, or Cloudflare WAF for edge DDoS protection.

The catch: the GitHub repo isn't the whole product. The detection engine ships as a prebuilt image, so you can't audit what does the blocking. And CVE-2026-92749 let attackers forge admin logins on versions through 9.4.1. Run 9.4.2 or later.

Free vs Self-Hosted vs Paid

open core

Free: Personal edition, free forever: semantic analysis engine, rule-based protection, HTTP flood and rate limiting, anti-bot challenges, dynamic HTML/JS protection, auth (SSO) challenge, access and error logs, community-shared threat IPs. Up to 10 apps, single-thread mode (docs rate Personal and Lite at up to 800 QPS on 1 core and 1 GB RAM).

Self-hosted: The only way to run it. Linux x86_64 (the Personal edition does not support ARM; ARM deployment is Pro-only) with Docker 20.10.14+ and Compose 2.0+, minimum 1 CPU, 1 GB RAM, 5 GB disk; docs recommend 2 GB RAM and 60 GB storage per 800 QPS for real traffic. Installs via a manager.sh script run as root and fetched with curl -fsSLk (the -k skips TLS verification), which pulls Docker images from Chaitin's registry. The GPL-3.0 repo holds the management console, MCP server, SDKs and plugins (ingress-nginx, Kong, Traefik); the detector, Tengine and other runtime services are prebuilt images.

Paid: Lite $10/month or $100/year: 20 apps, geo-blocking, Pro threat IP/JA4 feed, Discord and Telegram alerts, attack log export. Pro $100/month or $1,000/year: unlimited apps, ultimate (multi-core) performance mode, multi-user management, advanced dashboards, custom block pages, per-app advanced settings, upstream load balancing, response detection, master-slave config sync, ARM deployment (each node needs its own license). Ultimate: custom pricing, billed annually, with dedicated support and custom development. A promotion advertises up to 35% off Pro through Nov 30.

Free for up to 10 apps on a single-threaded engine. Lite is $10/month ($100/year) for 20 apps; Pro is $100/month ($1,000/year) per node for unlimited apps, multi-core performance and multiple admins.

What to do by team size

Solo: free Personal edition, up to 10 apps
Small team: free up to 10 apps; Lite at $10/month or $100/year for 20 apps and geo-blocking
Medium team: Pro at $100/month or $1,000/year per node for unlimited apps, multi-core performance and multiple admins
Large team: Pro per node or Ultimate (custom, annual); compare against Cloudflare WAF if you need edge DDoS absorption

Self-hosting ops:moderate

View pricing page →

Get tools like this every Wednesday

One featured tool, three on the radar. No fluff.