Shibuya – A High-Performance WAF in Rust with eBPF and ML Engine
Hi HN, I’ve been working on Shibuya, a next-generation Web Application Firewall (WAF) built from the ground up in Rust. I wanted to build a WAF that didn't just rely on legacy regex signatures but could understand intent and perform at line-rate using modern kernel features. What makes Shibuya different: Multi-Layer Pipeline: It integrates a high-performance proxy (built on Pingora) with rate limiting, bot detection, and threat intelligence. eBPF Kernel Filtering: For volumetric attacks, Shibuya can drop malicious packets at the kernel level using XDP before they consume userspace resources.…
Shibuya – A High-Performance WAF in Rust with eBPF and ML Engine launched on February 23, 2026 with 22 votes, #730 of 16,627 launches that month and more than 90% of that year's launches.
In plain words
Shibuya is a Web Application Firewall built in Rust that protects web applications from attacks using multiple defense layers. It combines a high-performance proxy with rate limiting, bot detection, and machine learning-based threat detection to identify attacks like SQL injection and cross-site scripting. The system uses kernel-level packet filtering for volumetric attacks and includes specialized protection for APIs and GraphQL endpoints. It is designed for organizations seeking modern security alternatives to traditional signature-based firewalls.
written from the facts on this page · September 2026
From the sources
SHIBUYA WAF: The most advanced open-source Web Application Firewall built in Rust. ML anomaly detection, eBPF kernel-level blocking, OWASP CRS 615+ rules, GraphQL protection, WASM plugins. Stop SQLi, XSS, RCE, zero-days in under 5ms.
The most advanced open-source WAF ever built. ML anomaly detection. eBPF kernel blocking. 615+ OWASP rules. The WAF that makes Cloudflare nervous. 9 weapons in one stack. Each module is a game-changer. Together, they're an impenetrable fortress built in Rust. Shibuya drops an XDP hook directly in the Linux kernel . Packets from known-malicious IPs get killed before they ever reach your application or even the WAF itself. IP blacklists stored in eBPF maps for O(1) lookup on millions of IPs. SYN flood protection included. Toggle on/off at runtime via Admin API — no restart needed. Two independent ML models run in parallel: an IsolationForest (via ONNX runtime) detects anomalies, and a Random…from ghostklan.com
In the maker’s words, at launch
Hi HN, I’ve been working on Shibuya, a next-generation Web Application Firewall (WAF) built from the ground up in Rust. I wanted to build a WAF that didn't just rely on legacy regex signatures but could understand intent and perform at line-rate using modern kernel features. What makes Shibuya different: Multi-Layer…
Does a similar job
all alternatives →
BunkerWeb – The Open-Source Web Application Firewall (WAF)2024 · github.com · ▲120🛡️ Open-source and cloud-native Web Application Firewall (WAF) - bunkerity/bunkerweb
BunkerWeb – the open-source and cloud-native WAF2025 · docs.bunkerweb.io · ▲106Documentation of BunkerWeb, the open source and next generation WAF.
Wachy – A UI for eBPF-based performance debugging2022 · rubrikinc.github.io · ▲116eBPF is an amazing technology that allows safely running user-supplied functions at pretty much arbitrary probe points in a kernel/user space context. Much has been written about how amazing this feature is for kernel observability. But as someone who writes user space code, what I find even more amazing is the support for tracing arbitrary user space programs, with no code changes and low overhead. However, doing in-depth analysis can get complicated and time-consuming. My goal with wachy was to make this debugging significantly easier/faster to use, by displaying traces in a TUI…
Hydrogen, a multithread non-blocking Linux server framework in Rust2016 · github.com · ▲154Multithreaded, non-blocking Linux server framework in Rust - nathansizemore/hydrogen
Whirlwind – Async concurrent hashmap for Rust2024 · github.com · ▲140Hey HN, this is Will and David from Fortress (https://news.ycombinator.com/item?id=41426998). We use a lot of async Rust internally, and created this library out of a need for an async-aware concurrent hashmap since there weren’t many available in the Rust ecosystem. Whirlwind is a sharded HashMap with a fully asynchronous API. Just as dashmap is a replacement for std::sync::RwLock, whirlwind aims to be a replacement for tokio::sync::RwLock. It has a similar design and performance characteristics to dashmap, but seems to perform better in read-heavy workloads with tokio's…
SwimOS Rust – A framework for real-time streaming data applications2024 · github.com · ▲71
More dev tools this month
the category →
Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.
Dev tools · 1d ago · github.com
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 29d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 27d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 24d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 22d ago · talanoa.email
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, February 2026
the whole month →
Lovon AI Therapy▲801Feel closer and have more fun with your partner every day!
AI · Feb 2026 · lovon.app
Hello my name is Ben Ward for the past 3 years I have been remastering the financial game Wall Street Raider created by Michael Jenkins originally on DOS in 1986. It has been a rough journey but I finally see the light at the end of the tunnel. I just recently redid the website and thought maybe the full story of how this project came to be would interest you all. Thank you for reading.
Work · Feb 2026 · wallstreetraider.com