Opportunities › High-performance Web Application Firewall › Proposed app
Latchline
Attack-aware web and GraphQL firewall with a phone-ready control room
- Score
- 36
- confidence 42
- Evidence
- 5
- items on the page
- Rivals
- 2
- named in sources
- First version
- 90 d
- estimate
- Type
- Desktop and mobile
- PWA: on computers and phones alike
- Market since
- 1999
- Mature market · AI estimate
ScreensConcept
Desktop and mobile: Security teams monitor and respond to attacks from operations centers at desks, but need phone access to alerts and quick actions during incidents. Sample screens on a computer and a phone, in the proposed brand. Their numbers are sample data.
Flagged requests
Last hour, watch mode14
About this appAI proposal
Latchline is a firewall for web apps and APIs that judges what a request is trying to do, not only whether it matches a pattern. A small filtering agent runs next to your app and drops floods early using eBPF. Suspicious requests are scored and classified (SQL injection, XSS, remote code execution) by a model that learns your normal traffic.
The installable web app is the control room. You review flagged requests, set GraphQL limits for depth and cost, switch a rule from watch to block, and get alerted when a flood starts. Custom checks are written as WebAssembly plugins and rolled out from the same place.
It is for small security and platform teams who run their own apps and APIs and find regex rule sets noisy or blind to API abuse. This is a proposal: performance and detection claims must be proven in a pilot before anyone relies on them.
- Tagline
- Stop the attack, not the customer.
- Voice
- CalmPreciseDirect
- Why this name
- A latch holds a door shut but opens for the right visitor. Line points to traffic flowing at line rate. Two plain words, easy to say.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Kernel-level flood filtering
An eBPF agent drops volumetric junk traffic before it reaches your app or proxy, with per-source rate limits you set from the console.
No member yet
Intent-based attack classification
Each suspicious request gets a class (SQLi, XSS, RCE, other) and a confidence score, instead of a bare rule ID.
No member yet
Learns your normal traffic
Anomaly scoring builds a baseline per route. Unusual payload shapes surface for review before you turn on blocking.
No member yet
GraphQL and API guardrails
Limit query depth, cost and aliases, block introspection in production, and check requests against your schema.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#0F2A2EDeep Teal · primary, icon background#F4F7F5Mist · surface#14262AInk · text#F2A33AAmber · accent#2F8F83Sea Green · data#C8453BAlarm Red · blocked status
Typography
Aa
Latchline
ABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789
PricingAI proposal
The material gives no competitor prices. These tiers are a starting point to test, based on the per-application and on-premises licensing in the opportunity.
Pilot
Free
- 1 app, watch mode only
- 7 days of request history
- Anomaly review
Team
$149 a month
- Up to 5 apps
- Blocking and GraphQL guardrails
- Wasm plugins
- 30 days of history
- Alerts to phone and chat
Self-hosted
Contact us
- On-premises control room
- Support and updates
- Single sign-on
- Custom retention
Would you pay Team · $149 a month?
Your answer tells PWAS which prices people accept. It changes no score.
No answers yet.
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- No loop in the product. A firewall is invisible to the end users of protected apps, so use does not spread by itself. Customers are reached through content, open-source pieces of the agent, and direct sales.
- Do they become customers?
- Test whether security-blog readers and open-source agent users will start a free pilot and then pay for blocking mode. Visitors to protected apps never see the product.
- First customers
- Platform and security leads at 20 to 200 person companies that run public GraphQL or REST APIs on their own Linux servers or Kubernetes.
- Where to reach them
- Hacker News and security forums: Post a technical write-up with measured results on replayed attack traffic, and invite readers to a free pilot.
- Open-source agent: Release the eBPF filter as open source and sell the control room, anomaly review and plugins.
- GraphQL communities: Share a free query-abuse checker in GraphQL meetups and chats, with a path to the pilot.
- First milestone
- Ten pilots in watch mode on live APIs, and three paying for blocking mode within 90 days.
Why people already pay for this
- VerifiedHacker News post received 22 points and 18 comments
- Public claimExisting WAFs rely on legacy regex signatures rather than understanding intent
- Public claimThere is a need for WAFs that can detect specific attack classes and anomalies
- Public claimAPI and GraphQL protection requires specialized deep inspection capabilities
- Public claim
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Edge agenteBPF/XDP filter in Rust or C, as a Linux daemonKernel-level dropping cannot run in a PWA; it needs an agent that customers install.
- This app · Traffic pipelineReverse-proxy module with Wasm runtimeRequest inspection and customer plugins need a sandboxed runtime next to the app.
RisksAI inference
- TechnicalHolding line-rate speed with in-path ML scoring and Wasm plugins is hard. A first version may need a lighter model or a sampling mode.
- AIFalse positives block real customers and false negatives miss attacks. Trust depends on watch mode and honest, measured detection rates.
- CommercialSecurity buyers trust established vendors. Evidence is one Hacker News post with 22 points, so demand is unproven.
- PlatformeBPF needs recent Linux kernels and privileges. Managed or serverless hosts may not allow it, which narrows the market.
- DataRequest bodies hold sensitive data. Storing them in a hosted control room needs redaction, and some buyers will refuse it.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.