Skip to content
Zarex
NewThe Zarex SDKs are available on npm

Application security, built for Africa.

Bots, attacks, abuse: every request is allowed or blocked before your code handles it. One SDK, a few lines, and pricing in CFA francs.

Start for freeRead the docs

Free up to 10,000 decisions a month · No credit card

The platform

Everything you need to protect your applications

A decision engine, one SDK per framework and a dashboard to see it all. Nothing else to install.

One call, one verdict

The SDK sends the request to the engine, which answers ALLOW or DENY. Your application decides what happens next.

Decision log

Every decision shows up in the dashboard: verdict, rule, country, IP address, engine response time.

IP Intelligence

The country and network (ASN) your traffic comes from, and the addresses that attack the most.

Projects and keys

One key per project and environment, live or test, revocable at any time.

For developers

Protected before your next deploy.

Install the package for your framework, add your key: every request gets an ALLOW or DENY verdict. Your application has nothing else to handle.

Protect

Shield, rate limiting and bot detection against attacks and abuse.

Learn more

Validate

Emails and phone numbers checked at sign-up, African operators included.

Learn more

Observe

Test in DRY_RUN, then follow every decision in the dashboard log.

Learn more

app/api/produits/route.ts · your code

# npm install @zarex/next

import { withZarex, shield, rateLimit } from "@zarex/next";

export const GET = withZarex(
  {
    key: process.env.ZAREX_KEY!,
    ipSource: "vercel",
    rules: [shield(), rateLimit({ max: 100, window: "1m" })],
  },
  async (request) => Response.json({ produits: [] })
);

Zarex response · GET /api/produits?id=1' OR '1'='1JSON

{
  "decision_id": "9f2c4e1a7b3d48e6a0c5f1d2b8e4a7c3",
  "verdict": "DENY",
  "results": [
    {
      "rule_type": "SHIELD",
      "verdict": "DENY",
      "is_dry_run": false,
      "reason": {
        "pattern": "sqli-tautology",
        "score": 92
      }
    }
  ],
  "ip": { "country": "DE", "asn": "AS60729" }
}

Block attacks, not your customers.

Each protection is one line of configuration, and you can test it risk-free before it goes live.

Shield (WAF)

SQL injection, XSS, path traversal, commands, SSRF, Log4Shell, SSTI. Path, query, body and headers, encoded ones included.

Fail-open

If Zarex is unreachable or slow, the request goes through. An outage on our side never takes your site down.

zarex : unreachable

ALLOW, request goes through

Bot detection

Real crawlers are verified by DNS. A fake “Googlebot” is blocked.

Rate limiting

Fixed or sliding window, or token bucket, per IP or per user.

Country and network

Allow or deny by the IP address's country or ASN.

Start for free

Every protection, 10,000 decisions per month, no credit card. Paid plans, billed in CFA francs with Mobile Money payment, are coming soon.

Paid plans in CFA francs · coming soon

Available today

Free

To try Zarex and protect a first project.

0XOF / month

  • 10,000 decisions / month
  • Every protection
  • Decision log
  • SDK for Next.js, Express, Fastify, SvelteKit, Bun
Start for free

The questions we get

Straight answers on setup, outages, data and the invoice.

Another question?

Ask us by email.

Write to us

Nothing for your visitors: the SDK is fail-open. If Zarex is unreachable, slow or answers unexpectedly, the request goes through. An outage on our side never blocks your site.

Protect your Next.js, Express, Fastify, SvelteKit or Bun app today.

Zarex blocks attacks, bots and abuse before they reach your code, and shows you every decision in the dashboard.

Start for freeRead the docs

Free up to 10,000 decisions a month · No credit card