Security middleware
that installs in two lines.
antsilk sits in front of your FastAPI / Starlette / Litestar app and does the boring half of web security for you — rate limiting, IP threat-intel, and SQLi / XSS / path-traversal scanning on every request. Blocks land as structured events in a local SQLite ledger.
Live ledger
Watch it block attacks in real time.
A live tail of antsilk's SQLite ledger, streamed from Supabase. Every row is a request that never reached a route handler.
window: Jul 17 – Jul 24
requests blocked
aggregate hits recorded in antsilk's SQLite ledger
Install
Two lines. A real WAF on day one.
Install the package, add the middleware. Defaults are tuned to be safe in production from the very first request — 60 req/min per IP, threat-intel from FireHOL + Spamhaus, full pattern scanning.
Zero runtime dependencies. Standard library only — nothing extra to audit, nothing to break your lockfile.
from fastapi import FastAPIfrom antsilk import AntsilkMiddleware app = FastAPI()app.add_middleware(AntsilkMiddleware)Restart your server. Every incoming request is now inspected, rate-limited, and logged.
Defense layers
Four checks, one middleware, zero services.
Each request runs the gauntlet cheapest-check-first. The route never sees anything that fails. No external calls, no runtime dependencies.
IP threat-intel
Traffic from IPs on FireHOL Level 1 or Spamhaus DROP is dropped before it touches your route. Feeds refresh every 6 hours.
Rate limiting
Per-IP token bucket, 60 req/min by default. Absorbs credential-stuffing and scraper bursts without a Redis dependency.
Pattern scanner
SQLi, XSS and path-traversal regex over the URL, query string and non-UA headers. Tuned to catch the payloads scanners actually send.
Header sanity
Missing User-Agent, known scanner signatures (sqlmap, nikto, masscan, nmap) and malformed cookies get bounced structurally.
SQLite ledger
Every block writes a row — timestamp, IP, path, rule, severity, raw UA — to a local WAL-mode SQLite file. PII never leaves your host.
Per-route overrides
Webhooks skip rate limiting, chatbot endpoints skip the pattern scan, payment routes skip threat-intel — all via one RouteRule.
How it works
One pipeline, front of every route.
Inspect every request
Threat-intel runs first because it's cheapest, then rate limit, then the regex scan over path / query / non-UA headers, then header sanity. The route never sees a blocked request.
Record what got stopped
Every block writes one row to a local SQLite ledger — timestamp, IP, path, rule, severity, status, raw User-Agent. Per-IP details stay on your host.
Carve out routes that need it
Webhooks bypass rate limiting, comment endpoints bypass the pattern scan, payment routes bypass threat-intel — each via a single RouteRule dataclass.
Stop shipping unprotected routes.
Add a real WAF to your ASGI app in the time it takes to read this sentence.