Node.js Quick Start
Get up and running in 5 minutes with Express or Fastify.
ContractShield
Contract-first API protection for Node.js, Python, and Java. Block what your app doesn't expect.
Start Building
Python Quick Start
Protect your FastAPI or Flask APIs with ContractShield.
Java Quick Start
Secure your Spring Boot applications with annotations.
Deployment Options
Deploy embedded, as a sidecar, or centralized.
Core Concepts
Define Contracts
Validate requests with JSON Schema — reject invalid payloads before they reach your code.
CEL Invariants
Write powerful business logic rules with CEL expressions.
Pro Features
Learning Mode
Observe API traffic and auto-generate security rules. The fastest way to bootstrap protection.
Sink-aware RASP
Block attacks that bypass validation — monitor SQL queries, file system access, and shell commands.
Policy Hot Reload
Update security rules without restarting your application.
Priority Support
Get answers within 24 hours. Your issues are triaged first.
Why ContractShield?
| WAF | API Gateway | ContractShield | |
|---|---|---|---|
| Sees parsed body | ❌ | ⚠️ | ✅ |
| Business logic rules | ❌ | ❌ | ✅ |
| Zero latency | ❌ | ❌ | ✅ |
| Framework-aware | ❌ | ❌ | ✅ |
ContractShield lives inside your application. It sees what your code sees — parsed JSON, typed parameters, business context. No proxy, no sidecar required, no latency added. Available for Node.js, Python, and Java.