Security

Last updated: 8 November 2026

WAP is a security product, and we hold it to that standard. This page explains how the platform protects you and how to report a vulnerability.

How WAP protects your application

• Requests are matched against your rules in memory before anything reaches your origin. Paths are canonicalised (percent-decoding, dot-segment and slash normalisation) before matching.
• Per-IP rate limits apply site-wide and per rule.
• Hop-by-hop and spoofable forwarding headers sent by clients are stripped. Your origin receives the true client IP in X-Forwarded-For and X-Real-IP.
• Every forwarded request carries X-WAP: <your team's secret token>. Configure your origin firewall to accept traffic only from the WAP edge, and your application to reject requests without this header.
• Origins must resolve to public addresses: WAP refuses to proxy into private, loopback or link-local networks, including after DNS changes.
• Requests to domains nobody has registered are refused with HTTP 401 and never forwarded.

How we protect your account

• Password-less sign-in with single-use magic links that expire after 15 minutes. Only hashes of tokens are stored.
• Session cookies are HttpOnly, SameSite and Secure; all forms are CSRF-protected.
• Strict Content-Security-Policy with no third-party scripts and a no-referrer policy on the console and sign-in pages. The public landing page loads only our visit-analytics script.

Responsible disclosure

Report vulnerabilities to security@onefirewall.com. See our security.txt. Please give us reasonable time to fix an issue before disclosure and avoid accessing other customers' data or degrading the service.