logSguarDian is a one-line middleware that classifies every incoming request with a Random Forest trained on ~380,000 labeled HTTP requests, and blocks SQL injection, XSS, path traversal, and command injection before they reach your route handlers — no proxy, no signature rules to tune.
npm install logsguardian
Small and mid-sized Node.js shops in Guatemala and across Latin America usually run without a dedicated security function. A properly-tuned WAF like ModSecurity is powerful, but configuring it — writing rules, managing paranoia levels, chasing false positives — takes expertise most five-person engineering teams don't have time to build.
One middleware line after your body parsers. No reverse proxy to stand up, no rule language to learn, no separate service to keep alive.
A Random Forest classifies structure and intent instead of matching known strings — the same reason it catches what pattern-matching WAFs miss.
Designed for defense in depth: it doesn't replace ModSecurity or Cloudflare, it catches what gets through. See the measurement →
Every request is turned into a 73-feature vector and scored by two models in dedicated worker threads, so ML inference never blocks Node's event loop.
Classifies each request as benign, sqli, xss, path_traversal, or cmdi. If the top class isn't benign and its confidence clears the threshold (0.35 by default), the request is blocked with an HTTP 403. RF is the only model with blocking authority.
Trained only on benign traffic, it flags statistically unusual requests that don't match a known attack signature — for logging and webhooks, not enforcement. A pass_anomaly verdict never becomes a 403.
If the RF worker hasn't loaded, crashes, or doesn't answer inside timeoutMs (50ms default), the request is forwarded unchanged. The middleware is built to never become a denial-of-service vector against your own app.
Full pipeline, decision-policy formula, and feature breakdown →
590 payloads from SecLists, deduplicated, run against a Postgres-backed vulnerable app in four configurations. logSguarDian was never tuned against this corpus before the run.
Of the 40 attacks CRS missed, logSguarDian independently caught 37. Only 3 payloads passed both layers — none were exploitable against the target app. That's the case for defense in depth, measured rather than assumed.
Ten limitations are documented with root-cause investigations in the repo. Three worth knowing before you install:
Models are trained offline and shipped fixed with each release. Detection quality depends on the version you install, not on how long it has run against your traffic.
Absolute overhead is small — roughly 0.1–15ms depending on environment — but the project's own ≤10% relative target isn't cleared against very low-latency baselines.
pass_anomaly is noisyThe Isolation Forest fires on ordinary benign traffic more often than its offline calibration suggests. It never blocks — but treat it as a noisy signal, not a precise one.
Sebastián Huertas built the middleware architecture, CLI, and library engineering. Diego Valenzuela built the ML pipeline, feature engineering, and model training. Both own testing and core logic.