◈ Evidence-driven migration, origin & AI security

WAF Migration Investigator

The WAF engineer’s Swiss Army knife — discover, compare, explain, and validate browser, proxy, origin, cache, rate-limit, bot, TLS, headers, and GenAI security. Local-first, evidence-backed, with a teachable “why it matters.”
No HAR loaded. Processing stays in this browser.
Client
HAR evidence
→
WAF / CDN
edge controls
→
Origin / AI
probe + logs
Evidence boundary: HAR captures browser-facing DNS, connection, request, response, redirect, timing, and headers. It normally cannot prove the WAF-to-origin route, source allowlist, private TLS trust, or backend logs.
▣ Session Vault 0 saved
Current investigation · unsaved
Primary / Protected HAR
Not loaded
Load the current/protected trace here.
Comparison / Before HAR
Not loaded
No comparison HAR loaded — before/after deltas are unavailable.
Load a HAR to build the visual assessment.
Load a HAR.

Request waterfall

Relative to the first HAR entry. Bars show request duration; slow and failed requests are highlighted.

Load a HAR.
Load a HAR.
Primary HAR not loaded
Comparison HAR not loaded
Local-only analyzer. HAR files may contain cookies, tokens, query strings, POST bodies, internal hostnames, and personal data—sanitize before sharing.
Session Vault
Named investigations are stored locally in this browser. HAR contents never leave the browser unless you export or share them yourself.
Saved evidence: Primary/Comparison HARs, feed state, provider lens, origin/domain evidence, server guide selection, AI mode, and current tab. Portable bundle: Export creates one local JSON file that can be imported on another browser or machine. Why it matters: reopen the investigation without reconstructing the evidence chain from scratch.
No saved sessions yet.
Domain Quick Probe
No HAR required. Generate a small evidence collection kit, run it locally, then paste the output back here.
Why this exists: a browser page cannot safely inspect arbitrary domains, private origins, certificates, or network paths because of CORS and browser sandboxing. Instead, Investigator gives the customer a copy/paste probe that runs where the evidence actually lives.
Customer-side probe
Probe target: —
Enter a domain above.
Paste returned output
Request details