Turrety is a WAF built for Node.js. It runs inside your NestJS, Express, Fastify or Hono app, then lets you watch its traffic in real time, manage every rule from one dashboard, and patch the CVEs in your dependencies before you upgrade. No redeploy, no proxy in the way.
The engine runs in your app. The control lives here.
One npm package with an adapter for every Node.js framework. Decisions happen in-process in microseconds, with the same verdict on a NestJS controller or a Next.js route handler. Turrety only sees sampled, redacted events and sends back rules.
1 · Install~13 µs per request · no extra hop
Add the SDK to your framework
import { TurretyModule } from '@turrety/node/nestjs';
@Module({
imports: [
TurretyModule.forRoot({
key: process.env.TURRETY_KEY
})
],
})
export class AppModule {}
import { turrety } from '@turrety/node/hono';
const app = new Hono();
app.use('*', turrety({ key: process.env.TURRETY_KEY }));
serve(app);
NestJS · NestJS 9 – 11 · Express or Fastify platform · Global module + middleware, guards untouched. Your app keeps enforcing its last rule set even if Turrety is unreachable.
Express · Express 4 · 5 · One middleware, mounted before your routes. Your app keeps enforcing its last rule set even if Turrety is unreachable.
Fastify · Fastify 4 · 5 · Plugin on the onRequest and preHandler hooks. Your app keeps enforcing its last rule set even if Turrety is unreachable.
Koa · Koa 2 · 3 · Middleware, works with any body parser. Your app keeps enforcing its last rule set even if Turrety is unreachable.
Next.js · Route handlers · API routes · Wrapper for handlers on the Node.js runtime. Your app keeps enforcing its last rule set even if Turrety is unreachable.
Hono · Hono on @hono/node-server · Middleware for the Node.js adapter. Your app keeps enforcing its last rule set even if Turrety is unreachable.
2 · Manage remotelyversioned · instant rollback
Change rules without a redeploy
Raise a level, disable a noisy rule or ship a custom one. Every agent pulls the new version within seconds, and any version can be rolled back.
Managed rulescheckout
1 unpublished changexss-js-primitives disabled · level stays high
xss12 of 14 active
xss-body
Possible XSS in body
balancedactive
xss-js-primitives
JavaScript primitive used to decode or exfiltrate a payload
highactive
xss-generic-tags
Generic HTML tag in request (paranoid XSS)
paranoidabove level
Agents
4 of 4 in sync
checkout-5b21-1
v413 s ago
checkout-5b21-2
v415 s ago
checkout-5b21-3
v412 s ago
checkout-5b21-4
v416 s ago
Why inside
A wall in front slows everyone down. A tower inside only stops attackers.
Most firewalls sit in front of your app as a proxy. Turrety stands inside it, so it adds no hop, knows your code, and costs the same whatever your traffic does.
A wall in front+1 network hop · 18,240 requests metered
Client Proxy holding… Your app
A tower inside Turrety~13 µs, in your process · 1 flat price per app
Client blocked Your app
Wall in frontTower inside · Turrety
SetupDNS change, TLS certificates, origin lockdown✓npm install and one line of code
LatencyAn extra network hop on every request✓Microseconds, inside your process
ContextSees raw HTTP only✓Knows your framework, routes and dependencies
New CVEsGeneric rules, the same for everyone✓Rules for the packages in your lockfile
If the service is downTraffic stops, or passes unprotected✓Your app keeps enforcing the last rule set
BillingPer request or per domain✓Per app. Request volume is never billed
~13 µsadded per request, measured inside your process
1 lineto install. No DNS, no certificates, no proxy to run
Flatprice per plan. Traffic spikes never raise your bill
A proxy in front still shines at soaking up volumetric floods. If you need that, keep it: Turrety works behind any of them.
New · Dependency-aware protection
Your lockfile already knows what to block.
The SDK reads your app's package-lock.json when it starts. Turrety matches every version against OSV or the GitHub Advisory Database and tells you which vulnerabilities a rule can actually stop. For those, it drafts the rule.
Scaneach time the app starts with a new lockfile
Triagea rule can stop it, or only an upgrade will, and why
CVE-2022-23540 · Signature validation bypass with insecure defaults
upgrade only
Beyond blocking
Blocking is the easy part.
The engine stops the attack inside your process. Turrety tells you about it, keeps the rules current and makes tuning safe.
01
Live traffic
Every decision your agents make, as it happens: the rule that decided and the request, across every app. Bodies and query values never leave your servers.
02
Remote rule management
Levels, presets and overrides for every app in one place. Publish in seconds, roll back any version, no redeploy.
03
Proposed rules
Turrety reads each app’s recent traffic and suggests changes: a client to block, a path to rate limit, a rule to test in shadow mode. Nothing ships until you accept it.
04
Custom rules
Write your own in the same format as the managed rules, with a visual builder and a JSON view, checked before anything is published.
05
Virtual patches
When a package in your lockfile has a known flaw, like the Next.js middleware bypass, Turrety drafts a rule that blocks the exploit until you upgrade, and retires it when you do.
06
Shadow mode
Try a rule, or a whole app in monitor mode, without blocking anything. See what it would have stopped, then turn it on.
Pricing
Priced per app, not per request.
Agent mode costs us almost nothing to run, so it shouldn't cost you much either.
Flat price plans keep 1M, 5M or 10M sampled events a month per organization, a limit you see in Billing, never a charge. Decisions are made in your process, so request volume is never billed.
Put a tower in front of it.
Free for your first app. Two minutes to your first blocked attack.