Engineering notes from Arcis. Releases, security research, and how to build security middleware that runs inside the application.
Open-source security middleware for Node, Python, and Go web apps. Same API across three SDKs, zero runtime deps in Node and Python, MIT licensed. Built by one person over eleven weeks. This is the introduction.
Identity tells you who. Observability tells you what happened. None of them stop the agent from actually firing a poisoned tool call at runtime.
Your XSS filter blocks <script>. Does it block the same six characters in fullwidth form? NFKC fixes a bypass class your regex was never going to see.
A WAF lives at the network edge and matches patterns against raw HTTP. Inside the application, the same request looks different.
| Date | Category | Title |
|---|---|---|
| May 28, 2026 | Launch | Introducing Arcis: one line of middleware, 30+ attack vectors handled |
| May 28, 2026 | Agents | Inside MCP: defending the runtime layer of agent security |
| May 23, 2026 | Detection | Normalize first, or you are matching the wrong string |
| May 19, 2026 | Supply Chain | Two years after xz: what supply chain tooling still does not catch |
| May 15, 2026 | WAF | The WAF blocked the obvious. Here is what it missed. |