I built a security layer for applications that developers can install in seconds
Building Defen. so: a developer-first security layer for modern applicationsMost developers know they should add more security to their applications. A WAF, vulnerability scanning, monitoring, rate limiting,. . .
Building Defen. so: a developer-first security layer for modern applicationsMost developers know they should add more security to their applications. A WAF, vulnerability scanning, monitoring, rate limiting, bot protection, file upload checks, security logs. . . But in practice, security often becomes a task for "later". The problem is that later usually means after something goes wrong. I started building Defen. so with a simple idea:Security should be part of the application from the beginning, not a separate project. GitHub:https://github. com/1fancy/defen. soWebsite:https://defen. soWhat is Defen. so?Defen. so is an application security layer that helps developers protect and monitor their applications without managing complex security infrastructure. It sits close to your application and provides protection, visibility and security tools from development to production. The goal is not to replace security teams or enterprise tools. The goal is to make strong security practices accessible to developers, startups and small teams. What it currently includes:Application protectionManaged WAF rulesSQL injection protectionXSS protectionBrute force preventionAPI abuse detectionBot detectionDDoS protectionFile upload securityMonitoringUptime monitoringPerformance visibilityReal-time security eventsAttack logsAlerts through email, Slack, Telegram and webhooksSecurity scanningDefen. so can scan applications and environments for common issues:Exposed configurationMissing security headersWeak settingsPublic filesCommon deployment mistakesThere is also a security scan designed around mistakes frequently seen in fast-built applications:Exposed secretsIncorrect cloud permissionsWeak authentication configurationMissing protection layersBuilt for developersInstallation is designed to be simple:npx @defen. so/initThe idea is that adding security should feel closer to installing a package than setting up a large infrastructure project. Supported ecosystems include:Node. js, PHP, Python, Go, Ruby, Rust, Java, . NET, Bun, DenoSecurity inside your coding workflowOne thing I found interesting while building this is how development workflows are changing. Many developers now use tools like Claude Code, Cursor, Windsurf and VS Code assistants. Defen. so includes an MCP server that allows these tools to interact with security information:Review routesCheck potential vulnerabilitiesAnalyse security issuesSuggest fixesReview application behaviourThe goal is to bring security closer to where code is written. Some technical decisionsFail open architectureA security layer should protect your application, not become another availability risk. If Defen. so is unreachable, the application continues serving traffic. You lose protection temporarily, not uptime. Framework-friendlyThe same idea should work whether you are building:A small SaaSAn APIA mobile backendA customer dashboardAn internal toolCurrent statusThe project is actively being developed and tested. Current features include:SDK packagesSecurity middlewareDashboardThreat monitoringScanning workflowsMCP integrationMultiple framework integrationsRepository:https://github. com/1fancy/defen. soI would love feedback from developers:What security tools do you currently use for your applications?What is the biggest pain point: setup, cost, complexity, or knowing what to fix?I'm especially interested in feedback from people building SaaS products and APIs.