Testing and security evaluation
AIWAF sandbox
Source and package versions
One AIWAF repository.
Python: py/aiwaf/ · Node.js: js/ · Rust/WASM: rust/ · Java: java/.
Source and canonical README.
Versions shown describe the source checkout; package releases are independent.
Current Python/Node source targets are aiwaf 1.1.8 (Python) and
aiwaf 1.1.5 (npm), with Rust/Python 0.2.7 and
WASM 0.2.5 and Java 1.3.5. Sandbox guides retain their separately pinned builds.
Run the same request checks across JavaScript, Python, and Java. Compare protected traffic with OWASP Juice Shop, exercise shared Redis state, and test application outcomes with a separate reference fixture.
Find the right guide
| Your goal | Guide | What it covers |
|---|---|---|
| Start from scratch | First sandbox run | Clone, build, verify source versions, and test one endpoint. |
| Look up an integration | Runtime and Redis reference | Services, ports, databases, state ownership, failure policies, and dependencies. |
| Evaluate protection | Validation and reports | Smoke, SQL outcomes, payload matrix, TLS, outages, scans, and report interpretation. |
| Understand the security scope | OWASP Top 10 coverage | Implemented scenarios, assessment boundaries, and remaining gaps. |
| Maintain the stack | Operations and troubleshooting | Source updates, Redis persistence, profiles, diagnosis, and cleanup. |
How it works
- RunnerSends normal requests, simulated clients, and payloads.
- AIWAF proxyApplies runtime controls before forwarding.
- RedisShares supported state under isolated namespaces.
- ApplicationJuice Shop supplies a vulnerable baseline; the reference fixture supplies outcome assertions.
The sandbox repository owns Compose, proxies, fixtures, and runners. BuildKit fetches AIWAF commit 843a35f4fd48b4ef565e3c1ec8a42db9b1c41946. No adjacent local AIWAF checkout is needed. Use a sandbox revision containing these source-context changes.
That commit builds Python/JavaScript 1.1.1 and Java 1.3.2. Source versions do not establish registry publication. PHP remains a separate Composer integration, excluded from the current fifteen-runtime validation.
Evaluate your build
Generate reports for the source commit, container images, and configuration you are testing. Run the validation workflow to check source versions, normal traffic, SQL login outcomes, TLS, failures, and dependencies.
Passing implemented scenarios does not close an entire OWASP category. See coverage and assessment boundaries before making a security claim.