Built for Node.js NestJS · Express · Fastify · Koa · Hono · Next.js

The watchtower over your apps.

Turrety is a WAF built for Node.js. It runs inside your NestJS, Express, Fastify or Hono app, then lets you watch its traffic in real time, manage every rule from one dashboard, and patch the CVEs in your dependencies before you upgrade. No redeploy, no proxy in the way.

$ npm install @turrety/node + one line to connect Turrety

Live decisions

412 blocked today
  • GET/products?id=1' OR '1'='1sqli-classic-queryblocked
  • POST/api/cartsqli-nosql-operatorblocked
  • GET/search?q=running+shoesstorefront-api · 11 µsallowed
  • GET/api/download?file=../../../../etc/passwdpath-traversalblocked
  • GET/_next/adminvp-cve-2025-29927blocked
  • GET/report?settings[view options][outputFunctionName]=xvp-cve-2022-29078blocked
  • GET/storefront-api · 10 µsallowed
  • POST/api/commentsxss-js-primitivesshadow
  • GET/wp-login.phpscanners-uablocked
18,240 requests checked · p50 11 µsIllustrative traffic
Drops intoNestJSExpressFastifyKoaNext.jsHono
How it works · made for Node.js

The engine runs in your app. The control lives here.

One npm package with an adapter for every Node.js framework. Decisions happen in-process in microseconds, with the same verdict on a NestJS controller or a Next.js route handler. Turrety only sees sampled, redacted events and sends back rules.

1 · Install~13 µs per request · no extra hop

Add the SDK to your framework

import { TurretyModule } from '@turrety/node/nestjs';

@Module({
  imports: [
    TurretyModule.forRoot({
      key: process.env.TURRETY_KEY
    })
  ],
})
export class AppModule {}

NestJS · NestJS 9 – 11 · Express or Fastify platform · Global module + middleware, guards untouched. Your app keeps enforcing its last rule set even if Turrety is unreachable.

2 · Manage remotelyversioned · instant rollback

Change rules without a redeploy

Raise a level, disable a noisy rule or ship a custom one. Every agent pulls the new version within seconds, and any version can be rolled back.

Why inside

A wall in front slows everyone down. A tower inside only stops attackers.

Most firewalls sit in front of your app as a proxy. Turrety stands inside it, so it adds no hop, knows your code, and costs the same whatever your traffic does.

Wall in frontTower inside · Turrety
SetupDNS change, TLS certificates, origin lockdown✓npm install and one line of code
LatencyAn extra network hop on every request✓Microseconds, inside your process
ContextSees raw HTTP only✓Knows your framework, routes and dependencies
New CVEsGeneric rules, the same for everyone✓Rules for the packages in your lockfile
If the service is downTraffic stops, or passes unprotected✓Your app keeps enforcing the last rule set
BillingPer request or per domain✓Per app. Request volume is never billed
~13 µsadded per request, measured inside your process
1 lineto install. No DNS, no certificates, no proxy to run
Flatprice per plan. Traffic spikes never raise your bill

A proxy in front still shines at soaking up volumetric floods. If you need that, keep it: Turrety works behind any of them.

New · Dependency-aware protection

Your lockfile already knows what to block.

The SDK reads your app's package-lock.json when it starts. Turrety matches every version against OSV or the GitHub Advisory Database and tells you which vulnerabilities a rule can actually stop. For those, it drafts the rule.

  1. Scaneach time the app starts with a new lockfile
  2. Triagea rule can stop it, or only an upgrade will, and why
  3. Patcha drafted rule, tried in shadow mode first
  4. Retirethe rule goes away when you upgrade

storefront-api · package-lock.json

1,284 packages · 4 vulnerabilities
  • critical
    CVE-2025-29927 · Authorization bypass in Next.js middleware
    rule drafted
  • critical
    CVE-2022-29078 · Template injection through render options
    rule drafted
  • high
    CVE-2024-45296 · Backtracking regular expressions in routes
    rule drafted
  • high
    CVE-2022-23540 · Signature validation bypass with insecure defaults
    upgrade only
Beyond blocking

Blocking is the easy part.

The engine stops the attack inside your process. Turrety tells you about it, keeps the rules current and makes tuning safe.

01

Live traffic

Every decision your agents make, as it happens: the rule that decided and the request, across every app. Bodies and query values never leave your servers.

02

Remote rule management

Levels, presets and overrides for every app in one place. Publish in seconds, roll back any version, no redeploy.

03

Proposed rules

Turrety reads each app’s recent traffic and suggests changes: a client to block, a path to rate limit, a rule to test in shadow mode. Nothing ships until you accept it.

04

Custom rules

Write your own in the same format as the managed rules, with a visual builder and a JSON view, checked before anything is published.

05

Virtual patches

When a package in your lockfile has a known flaw, like the Next.js middleware bypass, Turrety drafts a rule that blocks the exploit until you upgrade, and retires it when you do.

06

Shadow mode

Try a rule, or a whole app in monitor mode, without blocking anything. See what it would have stopped, then turn it on.

Pricing

Priced per app, not per request.

Agent mode costs us almost nothing to run, so it shouldn't cost you much either.

Hobby

$0forever
  • 1 app
  • 7-day event history
  • Live traffic
  • Dependency checks every day
Start free

Pro

$19/ month
  • 5 apps
  • 30-day history
  • Virtual patches, drafted on request
  • Dependencies checked on every deploy
  • Email, Slack & webhook alerts
Choose Pro

Enterprise

Customannual
  • Apps, seats and events without caps
  • A year of history
  • SLA & DPA
  • Help writing your rules
Talk to us

Flat price plans keep 1M, 5M or 10M sampled events a month per organization, a limit you see in Billing, never a charge. Decisions are made in your process, so request volume is never billed.

Put a tower in front of it.

Free for your first app. Two minutes to your first blocked attack.