Building Defen.so: a developer-first security layer for modern applications
Most developers know they should add more security to their applications.
A WAF, vulnerability scanning, monitoring, rate limiting, bot protection, file upload checks, security logs...
But in practice, security often becomes a task for "later".
The problem is that later usually means after something goes wrong.
I started building Defen.so with a simple idea:
Security should be part of the application from the beginning, not a separate project.
GitHub:
What is Defen.so?
Defen.so is an application security layer that helps developers protect and monitor their applications without managing complex security infrastructure.
It sits close to your application and provides protection, visibility and security tools from development to production.
The goal is not to replace security teams or enterprise tools.
The goal is to make strong security practices accessible to developers, startups and small teams.
What it currently includes:
- Application protection
- Managed WAF rules
- SQL injection protection
- XSS protection
- Brute force prevention
- API abuse detection
- Bot detection
- DDoS protection
- File upload security
- Monitoring
- Uptime monitoring
- Performance visibility
- Real-time security events
- Attack logs
- Alerts through email, Slack, Telegram and webhooks
- Security scanning
Defen.so can scan applications and environments for common issues:
- Exposed configuration
- Missing security headers
- Weak settings
- Public files
- Common deployment mistakes
There is also a security scan designed around mistakes frequently seen in fast-built applications:
- Exposed secrets
- Incorrect cloud permissions
- Weak authentication configuration
- Missing protection layers
- Built for developers
Installation is designed to be simple:
npx @defen.so/init
The idea is that adding security should feel closer to installing a package than setting up a large infrastructure project.
Supported ecosystems include:
Node.js, PHP, Python, Go, Ruby, Rust, Java, .NET, Bun, Deno
Security inside your coding workflow
One thing I found interesting while building this is how development workflows are changing.
Many developers now use tools like Claude Code, Cursor, Windsurf and VS Code assistants.
Defen.so includes an MCP server that allows these tools to interact with security information:
- Review routes
- Check potential vulnerabilities
- Analyse security issues
- Suggest fixes
- Review application behaviour
The goal is to bring security closer to where code is written.
Some technical decisions
Fail open architecture
A security layer should protect your application, not become another availability risk.
If Defen.so is unreachable, the application continues serving traffic.
You lose protection temporarily, not uptime.
Framework-friendly
The same idea should work whether you are building:
- A small SaaS
- An API
- A mobile backend
- A customer dashboard
- An internal tool
- Current status
The project is actively being developed and tested.
Current features include:
SDK packages
Security middleware
Dashboard
Threat monitoring
Scanning workflows
MCP integration
Multiple framework integrations
Repository:
https://github.com/1fancy/defen.so
I would love feedback from developers:
What security tools do you currently use for your applications?
What is the biggest pain point: setup, cost, complexity, or knowing what to fix?
I'm especially interested in feedback from people building SaaS products and APIs.
SOCIAL SHARE CARD GENERATOR