Every WAF marketing page talks about protection. Very few say which CVEs actually get blocked, which get detected but pass, which get monitored, and which are out of scope. We think the honest version is more useful.

This post is the public mapping between CWE identifiers, the standard vulnerability taxonomy, and the rule families we ship. The same table drives our live threat feed at /features.

Four verdicts we support

Blocks. The rule intercepts the request before it reaches your app. Attack log gets a row. The client sees a 403 or a decoy response. This is the standard WAF verdict.

Detects. The rule flags the pattern and writes an attack-log entry, but the request still reaches your app. Used for signals that carry too much false-positive risk to block outright, like hardcoded credentials in a request body.

Monitors. No rule fires, but the traffic pattern is recorded in the analytics feed. Used for classes of issue where the WAF cannot help but the SIEM should still know.

Out of scope. The vulnerability is real, but it does not live at the HTTP layer. Example: OpenSSH server bugs. Our job is to say so, not to pretend otherwise.

The mapping

CWE	Family	Rule	Verdict
CWE-79	Cross-site scripting	SDK-WAF-XSS	blocks
CWE-89	SQL injection	SDK-WAF-SQLI	blocks
CWE-22	Path traversal	SDK-WAF-PATH	blocks
CWE-77	Command injection	SDK-WAF-CMDI	blocks
CWE-78	OS command injection	SDK-WAF-CMDI	blocks
CWE-94	Code injection	SDK-WAF-CODEINJ	blocks
CWE-98	Remote file inclusion	SDK-WAF-RFI	blocks
CWE-434	Unrestricted file upload	SDK-UPLOAD-SCAN	blocks
CWE-611	XXE	SDK-WAF-XXE	blocks
CWE-918	SSRF	SDK-WAF-SSRF	blocks
CWE-502	Insecure deserialization	SDK-WAF-DESER	blocks
CWE-798	Hardcoded credentials	VIBE-SECRETS	detects
CWE-540	Info exposure through source	VIBE-SECRETS	detects
CWE-306	Missing authentication	SDK-WAF-AUTH	monitors
CWE-352	CSRF	SDK-WAF-CSRF	monitors
CWE-284	Improper access control	SDK-WAF-AUTHZ	monitors

What is not in the table

Kernel bugs, native binary vulnerabilities, and everything that lives below the request line. A CVE for OpenSSH or the Linux kernel is real but not in the WAF domain. We say so on the CVE row rather than pretend a WAF rule stops it.

The full mapping is versioned in the SDK. Every SDK release publishes a JSON manifest of which rules are active per plan tier. Fetch it at /api/policy once you have a token.