Heimdall Shield
The security engine behind the edge
A custom security engine written in Go that sits behind HAProxy and turns every request into a single Canonical Request Model — so that UNION, uNiOn, UN/**/ION and %55NION all become the same thing before a single detection engine looks at them. Not a regex WAF.
Why it is different
-
Not a regex WAF
No ModSecurity, no Coraza, no rule-language pattern matching. Heimdall parses the true wire bytes with its own HTTP engine and reasons about structure and intent, not string signatures.
-
Canonical Request Model
Every encoding of the same input — percent, double-encoding, case, Unicode, homoglyphs, HTML entities — collapses to one canonical form. Detection runs once, on the truth.
-
Specialized detection engines
Sixteen purpose-built engines (SQLi, XSS, SSRF, command injection, path traversal, SSTI, deserialization, NoSQL, file upload, SSI, memory corruption, header, protocol, API, rate, auth). None of them block — each returns risk, confidence and evidence.
-
Monitor-first
Shadow mode inspects and scores every request but never blocks, recording what enforcement would have done — until the false-positive rate is validated on real traffic.
-
Offline-only intelligence
AI/ML never decides in real time. The data lake, anomaly detection, clustering and LLM analyst produce human-gated rule suggestions, not live verdicts.
-
Open-core plugin SDK
The deterministic core is open source. Learned and at-scale intelligence attaches out-of-process through a stable gRPC plugin contract — no in-process coupling.
The pipeline in one line
Raw request → Normalization → Protocol parser → Canonical Request Model → Feature extraction → Detection engines → Risk engine → Decision → Origin.
Each stage is documented under Architecture and Engines; the exact functions that carry the flow are in Internals.
Where the project stands
The deterministic protection path — capture, normalize, parse, detect, score, decide, enforce — is complete and runs live. Feature extraction, endpoint intelligence and the control plane are functional and evolving. The learned / offline-ML tier and the identity plugins are the frontier. Each page marks live partial planned and enterprise so you always know plan from reality.