Gateweave Guard · Early access
Security in one place for teams on Cloudflare
See in one look what is wrong, what protects each zone and what got blocked, and get an email when something new and serious appears. Guard only reads: it never changes a Cloudflare setting or a repository.
Its code will be published under the AGPL-3.0, like the other products. Early access: expect rough edges and breaking changes.
Open findings
- CriticalA Security Insight on one of your domains
- HighA vulnerable package in a lockfile
- LowA zone whose WAF stopped far more than usual
An illustration of the list's shape, not real data. Findings are grouped by severity, and the ones raised since you last looked are marked New.
Findings
What is wrong, in one list
Connect a Cloudflare account and the GitHub repositories you care about. Guard scans every day, and whenever an admin asks, and lists what it finds by severity.
Cloudflare Security Insights
What Cloudflare's Security Center says is wrong with an account and its domains, read from the account with a read-only token.
Known vulnerabilities in your repositories
The npm and pnpm lockfiles of the GitHub repositories you connect, checked against OSV, one finding for each package and advisory.
WAF spikes
A zone whose WAF stopped far more requests yesterday than in the week before gets a low-severity finding, worth a look rather than an alarm.
A finding closes by itself when a scan no longer sees the problem, and reopens if it comes back. Admins can dismiss one with a reason, and it stays dismissed.
Protection
What protects each zone
For people who do not live in the dashboard: plain sentences, what is wrong first, and a link to fix it in Cloudflare.
- Managed rules, custom rules and rate limiting
- Bot Fight Mode and Under Attack mode
- Each custom rule's description, action, whether it is on, and how much it acted
- One line for each issue across all zones, such as "Bot Fight Mode off on 21 of 30 zones"
Each part reads on its own, so a token without one permission still shows the rest and says which permission is missing.
Traffic
What got blocked
Counts of what Cloudflare's WAF and bot protection did to each zone's requests, by day.
- Daily counts of what the WAF and bot protection stopped or challenged
- By action, rule, country and host, for each zone
- This week against last week, and yesterday's busiest rules
- Never visitors' IP addresses, user agents or paths
The daily counts are kept for 90 days. Rule activity comes from sampled events, so Guard says "No activity recorded" and never that a rule did nothing.
Alerts
Told when something new and serious appears
Three ways, and the first needs nothing set up.
A badge
Findings raised since you last looked are marked New, and the sidebar counts them. Nothing to set up.
An email for new critical and high findings
One email a workspace, at most one an hour, with each finding's title and where it is. Findings a new connection already had on its first scan send none.
A weekly summary
On Mondays: what is open by severity, what is new and resolved this week, and how much the WAF and bot protection stopped or challenged.
Each member switches the two emails on or off in Settings, and every email has a one-click unsubscribe link. They show titles and counts, never a token or anything from a request.
From a finding to work
Fixed where your team plans its work
Connect a Gateweave Track workspace with an agent member's key, and every finding is one click from an issue.
File it in Gateweave Track
One click makes an issue in your team's Track: the finding's title, where it is, its severity as the priority, and a link back. One issue per finding, however many people click.
Ask Gateweave Agents for a fix
For a vulnerable package with a fixed version, Guard files the issue with the label your Agents trigger watches, and the agent opens the pull request. Guard holds no Agents key.
Guard sends Track only what it found, never a token or anything from a request. A person still reviews and merges the fix.
Read only
It looks, and never touches
Guard asks for the least access that reads. Nothing in it changes a Cloudflare setting, a rule or a file.
Three permissions, three more if you want them
Cloudflare: Security Center Insights and Analytics, read. For the Protection page, optionally WAF, Bot Management and Zone Settings, read. GitHub: Contents, read-only, for one repository.
Tokens sealed, never shown again
A token is checked, then encrypted before it is stored. Pages show only its last four characters. Owners and admins connect; everyone in the workspace sees findings, never tokens.
What it keeps is small
Findings keep what a page shows, not what was read: no Cloudflare payload and no lockfile contents. A rule's expression, which can hold secrets, is never read or kept.
The package names and versions in a lockfile go to OSV to look up advisories. Never the repository's name or files.
Self-hosting or Cloud
Run it yourself, or let us run it
The same code either way.
Self-host on Cloudflare
Guard deploys as a single Worker, with a D1 database and a Durable Object, to your own Cloudflare account. The Deploy button and the self-hosting guide come when the code is published.
- It needs the Workers Paid plan. The first account owns the deployment and decides who else may sign up.
- Email, sign-in through your own OpenID Connect provider and where your data lives are yours to set.
Gateweave Cloud
The hosted version, at guard.gateweave.com. We open it to workspaces in turn, from the waitlist.
- Nothing to deploy or operate
- Your data is stored in the EU
- Sign in with Gateweave ID, or with email and a password
- Built from the same code
Planned
What comes next
Guard ships one finished piece at a time. None of this is available yet.
- An MCP server, so that AI agents can read your findings
- More ways to be told: Slack, webhooks and a push to a phone