Framework-agnostic application-layer API security engine.

Rust port of guard-core's detection engine. Work in progress: currently covers only the CPU-bound detection pipeline. Handlers, protocols, decorators, and I/O layers are not yet ported.

Re-exports the detection engine modules:

[compiler] - regex pattern compilation with LRU caching and ReDoS safety validation
[detect] - the spec 4.0.2 detection pipeline entry point (detect, [detect::DetectConfig], [detect::DetectVerdict])
[preprocessor] - unicode NFKC normalization, URL/HTML decoding, null byte removal, whitespace collapsing, and attack-preserving truncation
[semantic] - token extraction, Shannon entropy, encoding layer detection, attack probability scoring, obfuscation detection, code injection risk analysis, and aggregate threat scoring

Usage

use guard_core_rs::preprocessor;
use guard_core_rs::semantic::AttackKeywords;
use guard_core_rs::semantic::AttackStructures;
use guard_core_rs::semantic::{self};

let raw = "<scr\u{200B}ipt>alert(1)</script>";
let clean = preprocessor::preprocess(raw, 10_000, true);

let kw = AttackKeywords::default();
let st = AttackStructures::default();
let result = semantic::analyze(&clean, &kw, &st);
let score = semantic::get_threat_score(&result);

assert!(score > 0.0);

guard-core-rs 4.0.4

Usage