Fix the flaw.Stop the attack.
Xaish does both. Agents write the patch that removes a vulnerability from your code, and the Runtime Shield blocks attacks on that vulnerability while your application is running, so you are protected in the days between finding a flaw and shipping its fix.
Two jobs, both included
A patch fixes the lock. The shield is the guard who stops someone picking it in the meantime. You need both, and both are in the $10,000 monthly subscription.
| Writing the patch | Stopping the attack at runtime | |
|---|---|---|
| What it does | Removes the flaw from the code for good. | Refuses the attack on live traffic, before it reaches your app. |
| When | Before the next release. | Now, while the application is running. |
| Speed | As fast as you can review, test and deploy. | In milliseconds: 0.8 ms added per request, measured. |
| The flaw itself | Gone. | Still in the code, but unreachable until the patch ships. |
| Who writes it | Xaish agents write the code change, version pin or hardened config. | Xaish agents write the virtual patch; the OWASP Core Rule Set covers the known attack families. |
| Industry name | SAST and SCA remediation. | WAF with virtual patching. |
Measured, not promised
We sent 65 attacks and 38 ordinary requests, some of them deliberately awkward, through the shield in front of a test application.
- Template and code injection4 of 6
- Command injection6 of 8
- Log4Shell (JNDI)4 of 4
- Path traversal9 of 9
- SQL injection17 of 17
- SSRF and remote file inclusion5 of 6
- Cross-site scripting13 of 13
- XML external entities0 of 2
A test endpoint let users make themselves administrators by adding one field to their profile. No generic rule set can know that: the OWASP rules blocked 0 of 4 attempts. Agent #146 read the attack in the logs and wrote a virtual patch. With it installed, the shield blocked 4 of 4, and 3 of 3 legitimate profile updates still went through.
Engine: OWASP Coraza (coraza-caddy v2.6.2) + OWASP Core Rule Set, paranoia level 1. Scope: web and API traffic over HTTP. The shield does not see what happens inside a host; containment there is decided by agent #145 and carried out through your own EDR.
How it works
- 01Find
Scanners and agents find the vulnerability in your code, cloud or dependencies.
- 02Patch
An agent writes the code fix: the exact change, version pin or hardened config, with a test plan.
- 03Shield
Agent #146 writes a virtual patch for the same flaw. You approve it, and the shield enforces it within a minute, with no restart.
- 04Ship
When the code fix is deployed, remove the virtual patch. The OWASP Core Rule Set keeps guarding everything else.
Deploy
The shield runs as a container in front of your application, in your own infrastructure. Your traffic never passes through Xaish; only the rules come from us. The image is provided at onboarding.
docker run -d -p 443:8080 \ -e SHIELD_UPSTREAM=http://your-app:3000 \ -e XAISH_URL=https://xaish.com \ -e XAISH_API_KEY=<workspace API key> \ xaish-runtime-shield
A rule set the engine cannot load is rolled back to the last good one, and a virtual patch can only add blocking: Xaish refuses any rule that would switch the engine off, remove other rules or let traffic skip them.