clawbot 22b52dfd6d The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25) ...

Coraza v3.8.1 runs the Core Rule Set 4.25.0 (coraza-coreruleset v4.25.0)
after the rule files, with the six changes and the default
SWWAF_WAF_DISABLED_RULES that SPEC.md gives; no body, no response.
SWWAF_WAF_MODE, SWWAF_WAF_PARANOIA_LEVEL, SWWAF_WAF_ANOMALY_THRESHOLD and
SWWAF_WAF_EXEMPT_PATHS as specified. In block mode a match is refused with
403, an offence counted toward the error burst; in detect mode it is let
through. Both log waf_rule_ids, waf_score and duration_waf, raise
waf_block, and count smallwebwaf_waf_matches_total.

Judgement call: waf_block is raised in block mode too.
Deviation: no engine-error path; with no body read, Coraza cannot fail.

Model: opus-5-5

2026-10-08 05:44:13 +00:00

..

config_test.go

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 05:44:13 +00:00

config.go

The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

2026-10-08 05:44:13 +00:00