Documentation
Source and package versions
One AIWAF repository.
Python: py/aiwaf/ · Node.js: js/ · Rust/WASM: rust/ · Java: java/.
Source and canonical README.
Versions shown are the latest published releases; each package is versioned independently.
Current versions are aiwaf 1.1.8 (Python) and
aiwaf 1.1.5 (npm), with Rust/Python 0.2.7 and
WASM 0.2.5 and Java 1.3.5. Sandbox guides retain their separately pinned builds.
How AIWAF works: system architecture
Find the right kind of guide
New to AIWAF? Start with the tutorial. For an existing application, choose a task guide. Use topic guides to understand decisions and reference pages to look up runtime details.
| Your goal | Start here | What to expect |
|---|---|---|
| Learn by building | Tutorials | A connected example with complete files and checkpoints. |
| Understand how protection works | Topic guides | Request flow, route decisions, state ownership, and the learning loop. |
| Complete a specific task | How-to guides | Framework integration, operations, upgrades, and troubleshooting. |
| Look up a setting or interface | Reference | Configuration defaults, runtime interfaces, adapters, and bindings. |
Browse the complete documentation contents
Test your protected application: runnable Flask and Django tests, state isolation, and a plan for full-stack and multi-worker checks.
Join a sprint: how to set up, review pull requests, and submit changes to AIWAF, its website and the sandbox.
Build your first protected app
Follow complete files from installation to route discovery, a verified rate limit, selective exemptions, and request logs.
Start the six-step tutorial | Choose your learning path and framework
Understand the architecture
Follow a request through adapters, route policies, deterministic checks, state, and response observations. Then see how logs feed the next model.
Read the system overviewPython internals | Node.js internals | Java internals | Rust/WASM internals
Current package matrix
Python and Node.js use ELv2 from version 1.1.2 onward, Rust/Python and WASM from 0.2.2, and Java from 1.3.3 for releases distributed under those terms. Previously distributed MIT copies retain their MIT permissions.
The matrix lists the latest published versions. Check your installed versions before upgrading. See source defaults for the source snapshot and the sandbox guide for its separately pinned package versions.
| Runtime | Package | Published version | Primary use |
|---|---|---|---|
| Python | aiwaf | 1.1.8 | Django, Flask, and FastAPI protection |
| Node.js | aiwaf | 1.1.5 | Express and Node framework middleware |
| Rust/Python | aiwaf-rust | 0.2.7 | Native CSV policies, training, and model inference |
| WebAssembly | aiwaf-wasm | 0.2.5 | Rust detection and model primitives for JavaScript |
| Java | io.github.aiwaf-project:aiwaf-java | 1.3.5 | Spring MVC and Jakarta Servlet protection |
Supported framework integrations include Django, Flask, FastAPI, Express, Fastify, Hapi, Koa, NestJS, Next.js API routes, AdonisJS, Sails.js, Spring MVC, and Jakarta Servlet.
Python
Reference for AIWAF architecture, storage, middleware, training lifecycle, CLI surface, tests, and release pipeline for Python.
Open Python Deep-Dive DocsJavaScript
Reference for AIWAF Node.js middleware architecture, framework integrations, end-to-end setup guide, storage/training lifecycle, CLI operations, and packaging.
Open JavaScript Deep-Dive DocsPHP (Legacy Reference)
Historical PHP integration pages. PHP is absent from the current monorepo and is not part of its current package or release matrix.
Open Legacy PHP ReferenceJava
Reference and setup guide for AIWAF-Java with framework-agnostic engine usage, Spring/Servlet integrations, runtime storage backends, and CLI/admin operations.
Open Java Deep-Dive DocsRust Accelerator
Deep-dive docs for aiwaf-rust covering PyO3 bindings, WASM exports, Isolation Forest semantics, integration patterns, and build/test workflows.