Hey Product Hunt! As developers scaling Node.js applications, we constantly hit a wall with traditional security tools: WAFs block threats but leave us blind to the actual incident forensics, and in-app tools (RASP/APM) introduce unacceptable overhead or memory leaks under DDoS pressure. We built Tracehound to be the definitive Security Buffer Layer. It acts as a deterministic runtime membrane between your API request and your business logic. What it does: - Composite Rate Limiting: Hash-based source tracking (IP + UA + TLS fingerprinting) that prevents bucket-rotation bypass. - Deterministic Quarantine: A priority-bounded buffer that physically isolates malicious payloads without exploding memory. - AuditChain: Every quarantine event is hashed and Merkle-linked, creating an immutable, cryptographically verifiable forensic record. - Fail-Open Architecture: If Tracehound panics, your host app stays up. It is designed to never become a DoS vector. Tracehound doesn’t replace your WAF—it catches what your WAF flags (or what slips through) and preserves the evidence for SOC2/HIPAA compliance and incident response. It’s completely open-core, with thin adapters for both Express and Fastify. Check out the repo, run the CLI visualization demo, and let me know your thoughts on our fail-open architectural choices! Happy to answer any technical questions.

Tracehound

Deterministic security buffer and forensic runtime.

Deterministic security buffer and forensic runtime.