# VeilGate

> Apache-2.0 deception reverse proxy for bot, scanner, and LLM-agent defense. VeilGate scores requests, challenges ambiguous traffic with proof-of-work, and routes hostile automation into believable tarpits.

## Primary URLs

- [Website](https://veilgate.dev/) - Product overview and operator positioning.
- [Documentation](https://veilgate.dev/docs/README.md) - Technical docs for setup, architecture, configuration, operations, and reference material.
- [Glossary](https://veilgate.dev/glossary) - Definitions for VeilGate terms.
- [Community rules](https://veilgate.dev/rules) - MIT-licensed detection rules overview.
- [GitHub repository](https://github.com/C0oki3s/veilgate) - Apache-2.0 core source.
- [Browser client](https://github.com/C0oki3s/veilgate-client) - Automatic browser PoW solving SDK.
- [Node client](https://github.com/C0oki3s/veilgate-node) - Node.js SDK for automatic PoW solving and verifier credentials.
- [Community rules repository](https://github.com/C0oki3s/veilgate-rules) - MIT-licensed YAML rules.

## Documentation Map

- [Getting Started](https://veilgate.dev/docs/getting-started/README.md) - This guide gets VeilGate running locally, then shows how to verify scoring, metrics, challenge behavior, and tarpit behavior.
- [VeilGate Docs](https://veilgate.dev/docs/README.md) - This directory keeps the technical documentation needed to run, operate, and contribute to VeilGate.
- [VeilGate Documentation](https://veilgate.dev/docs/index.md) - VeilGate is a deception reverse proxy. It receives HTTP traffic, calculates a request score, and then selects one of four decisions: real, observe, challenge, or tarpit.
- [Architecture](https://veilgate.dev/docs/architecture/README.md) - VeilGate is a reverse proxy with a scoring layer and a deception backend.
- [How VeilGate Processes a Request](https://veilgate.dev/docs/architecture/request-processing.md) - This page describes the runtime flow implemented by cmd/veilgate and internal/proxy. It is similar in purpose to NGINX request processing documentation, but the phases are VeilGate specific: resolve client identity, scor
- [Configuration Reference](https://veilgate.dev/docs/config/README.md) - VeilGate has two configuration surfaces:
- [capture:](https://veilgate.dev/docs/config/capture.md) - File: /etc/veilgate/veilgate.yaml Section: capture: Reload: restart required.
- [challenge:](https://veilgate.dev/docs/config/challenge.md) - File: /etc/veilgate/veilgate.yaml Section: challenge: Reload: restart required.
- [detector:](https://veilgate.dev/docs/config/detector.md) - File: /etc/veilgate/veilgate.yaml Section: detector: Reload: restart required. The detector's rule logic (UA substrings, header tiers, timing, toolchain, injection markers) lives in rules/detector.yaml. This page documen
- [metrics:](https://veilgate.dev/docs/config/metrics.md) - File: /etc/veilgate/veilgate.yaml Section: metrics: Reload: restart required.
- [How Configuration Is Resolved](https://veilgate.dev/docs/config/overrides.md) - This page explains where each VeilGate setting comes from at runtime and which changes require a restart. It follows the same directive oriented style used by the module docs: source, default behavior, code path, and ope
- [persist:](https://veilgate.dev/docs/config/persist.md) - File: /etc/veilgate/veilgate.yaml Section: persist: Reload: restart required.
- [tarpit:](https://veilgate.dev/docs/config/tarpit.md) - File: /etc/veilgate/veilgate.yaml Section: tarpit: Reload: restart required.
- [telemetry:](https://veilgate.dev/docs/config/telemetry.md) - File: /etc/veilgate/veilgate.yaml Section: telemetry: Reload: restart required.
- [tls:](https://veilgate.dev/docs/config/tls.md) - File: /etc/veilgate/veilgate.yaml Section: tls: Reload: restart required.
- [Top-level keys](https://veilgate.dev/docs/config/top-level.md) - File: /etc/veilgate/veilgate.yaml Reload: restart required (sudo systemctl restart veilgate).
- [upload_policies:](https://veilgate.dev/docs/config/upload-policies.md) - File: /etc/veilgate/veilgate.yaml Reload: restart required (sudo systemctl restart veilgate).
- [verifiers:](https://veilgate.dev/docs/config/verifiers.md) - File: /etc/veilgate/veilgate.yaml Section: verifiers: Reload: restart required for the block itself; client secrets hot reload on file mtime change.
- [Rules Directory Reference](https://veilgate.dev/docs/config/rules/README.md) - This directory documents every YAML file under rules dir. Rule files control detector scoring, TLS labels, tarpit content, challenge presentation, ML settings, dashboard layout, and miner managed learned candidates.
- [veilgate-rules](https://veilgate.dev/docs/community-rules-README.md) - Community maintained detection rules for VeilGate, the open source deception reverse proxy.
- [rules/challenge.yaml](https://veilgate.dev/docs/config/rules/challenge.md) - File: /.veilgate/rules/challenge.yaml Reload: hot reload ( 500 ms). Presentation layer for the proof of work challenge. The runtime secret + difficulty + TTL are in the proxy config under challenge:; this file controls h
- [Rule Customization Guide](https://veilgate.dev/docs/config/rules/customization.md) - The veilgate rules customization guide explains how to customize VeilGate rule files safely. It follows the documentation pattern from DOCSskill.md: directive style fields, code paths, operational notes, and validation c
- [rules/dashboard.yaml](https://veilgate.dev/docs/config/rules/dashboard.md) - Syntax: dashboard configuration Default: embedded dashboard.yaml Context: rules dir
- [rules/detector.yaml](https://veilgate.dev/docs/config/rules/detector.md) - File: /.veilgate/rules/detector.yaml Reload: hot reload via fsnotify ( 500 ms debounce). The rule definitions for every signal in the rule based scorer. Top level thresholds and trust lists live in detector: on the proxy
- [rules/fake_data.yaml](https://veilgate.dev/docs/config/rules/fake-data.md) - Syntax: fake profile data pools Default: embedded fake data.yaml Context: rules dir
- [rules/injection_strategy.yaml](https://veilgate.dev/docs/config/rules/injection-strategy.md) - File: /.veilgate/rules/injection strategy.yaml Reload: hot reload ( 500 ms). Two part config: the route table that maps tarpit bound requests to response templates, and the injector knobs that pick how many prompt inject
- [rules/ip_reputation.yaml](https://veilgate.dev/docs/config/rules/ip-reputation.md) - File: /.veilgate/rules/ip reputation.yaml Reload: hot reload ( 500 ms). Three things in one file: CIDR based IP categorisation, fleet rotation detection thresholds, and User Agent rotation thresholds.
- [rules/learned.yaml and rules/learned/](https://veilgate.dev/docs/config/rules/learned.md) - Syntax: learned rule candidate file (flat) or per feature directory Default: candidates: [] Context: ML miner workflow, community rules distribution
- [rules/ml.yaml](https://veilgate.dev/docs/config/rules/ml.md) - File: /.veilgate/rules/ml.yaml Reload: hot reload (changes apply within 500 ms). Hyperparameters for the online ML signal: Naive Bayes + Isolation Forest. Also configures path redaction and the rule mining loop. See mode
- [rules/payloads.yaml](https://veilgate.dev/docs/config/rules/payloads.md) - File: /.veilgate/rules/payloads.yaml Reload: hot reload ( 500 ms). Tarpit payload library. Each tarpit response gets a small set of these payloads woven into it. The goal is to make an attacker's LLM consume tokens on fa
- [rules/signals.yaml](https://veilgate.dev/docs/config/rules/signals.md) - File: <rules dir /signals.yaml Reload: hot reload via fsnotify ( 500 ms debounce). Controls which detection signals are active, how many points they contribute, and lets you define entirely new detection rules without wr
- [rules/templates.yaml](https://veilgate.dev/docs/config/rules/templates.md) - File: /.veilgate/rules/templates.yaml Reload: hot reload ( 500 ms). Response bodies served by the tarpit. Each template is selected by a route in injection strategy.yaml. Bodies are Go text/template strings with access t
- [rules/tls_fingerprints.yaml](https://veilgate.dev/docs/config/rules/tls-fingerprints.md) - File: /.veilgate/rules/tls fingerprints.yaml Reload: hot reload ( 500 ms). Database of known JA3 / JA4 fingerprints. Read by the tls agent / tls bot / tls non browser signals. Active only when tls.enabled: true VeilGate 
- [rules/vulnerabilities.yaml](https://veilgate.dev/docs/config/rules/vulnerabilities.md) - Syntax: tarpit vulnerability helper lists Default: embedded vulnerabilities.yaml Context: rules dir
- [Linux Deployment](https://veilgate.dev/docs/deployment/README.md) - The supported deployment target is a Linux host running VeilGate as a systemd service.
- [Credential Verifiers — Design & Ship Tracker](https://veilgate.dev/docs/design/credential-verifiers.md) - Status: in progress. Raised by: Jai, 2026 05 17 discussion (continuation of Challege.md). Companion docs: ../../Challege.md, ../modules/veilgate challenge.md.
- [Functionality Index](https://veilgate.dev/docs/functionalities/README.md) - This directory contains detailed references for each VeilGate functionality area. The pages follow DOCSskill.md: runnable example, directives, Syntax, Default, Context, implementation code paths, operational notes, valid
- [Admin Dashboard](https://veilgate.dev/docs/functionalities/admin-dashboard.md) - The admin dashboard is the browser UI and JSON API for operating a VeilGate instance. It is implemented as a separate binary from the proxy so operators can start, stop, and expose it independently.
- [Module veilgate_audit](https://veilgate.dev/docs/functionalities/audit-and-forget.md) - The veilgate audit module records operator and system actions in a hash chained audit log. It also documents the veilgate forget command, which deletes persisted rows for a client identifier and records the deletion.
- [Module veilgate_challenge](https://veilgate.dev/docs/functionalities/challenge-handler.md) - The veilgate challenge module serves proof of work challenges for requests that are suspicious but not high confidence tarpit traffic. It issues a signed pass token after a valid solution. The token can be carried as an 
- [Module veilgate_proxy](https://veilgate.dev/docs/functionalities/client-identity.md) - The veilgate proxy module documents how VeilGate acts as a reverse proxy, resolves client identity, applies decisions, and protects detector state from spoofed forwarded headers.
- [Detection Signals](https://veilgate.dev/docs/functionalities/detection-signals.md) - VeilGate evaluates up to 43 built in signals per request. Each signal that fires contributes a fixed point value to the total score (0–100). Signals are additive — multiple signals firing on the same request are summed, 
- [Detector Score System](https://veilgate.dev/docs/functionalities/detector-score-system.md) - The detector assigns a score between 0 and 100 to every request. The score is an additive sum of all fired signal points, capped at 100. The proxy uses that score — together with mode, score challenge threshold, and scor
- [Module veilgate_verifier](https://veilgate.dev/docs/functionalities/hmac-verifier.md) - The veilgate verifier module documents optional request verifier chains. The current implemented verifier is HMAC. A verifier can mark a non tarpit request as trusted enough to skip the challenge tier.
- [HTTP/2 Fingerprinting](https://veilgate.dev/docs/functionalities/http2-fingerprinting.md) - This functionality page mirrors Module veilgate http2 fingerprinting for feature oriented navigation.
- [Module veilgate_rules](https://veilgate.dev/docs/functionalities/ip-reputation-and-rotation.md) - The veilgate rules module documents external YAML rule files. These files define detector weights, fingerprint classifications, tarpit templates, route strategy, fake data, payloads, challenge behavior, ML settings, and 
- [Module veilgate_metrics](https://veilgate.dev/docs/functionalities/metrics-dashboard.md) - The veilgate metrics module exposes Prometheus metrics and the built in dashboard. It is served by a separate HTTP server from the proxy listener.
- [Module veilgate_ml](https://veilgate.dev/docs/functionalities/online-ml.md) - The veilgate ml module documents optional online ML scoring and rule mining. ML is an additive detector signal, not the primary enforcement engine. The deterministic detector and thresholds still control final routing.
- [Operator And Test Tools](https://veilgate.dev/docs/functionalities/operator-tools.md) - This functionality page covers the helper commands used to validate VeilGate behavior outside the main request path.
- [Module veilgate_persistence](https://veilgate.dev/docs/functionalities/persistence-event-store.md) - The veilgate persistence module documents the SQLite backed event store. It records request events, feature rollups, learned rule candidates, audit entries, and tarpit canary state.
- [Module veilgate_core](https://veilgate.dev/docs/functionalities/proxy-routing.md) - The veilgate core module describes the top level runtime fields that decide where VeilGate listens, which upstream application receives clean traffic, which operating mode is active, and where external rule files are loa
- [Module veilgate_capture](https://veilgate.dev/docs/functionalities/request-capture.md) - The veilgate capture module writes one JSONL record for each scored request. It is useful for legacy pipelines, traffic review, and training data export. For normal operations, the SQLite persistence module is usually pr
- [Request Classification: SPA, Browser Page, and Server-to-Server](https://veilgate.dev/docs/functionalities/request-classification.md) - VeilGate does not make a single binary "is this a browser?" decision. Instead it uses two independent classification systems that operate on the same request in parallel:
- [Module veilgate_rules](https://veilgate.dev/docs/functionalities/rules-hot-reload.md) - The veilgate rules module documents external YAML rule files. These files define detector weights, fingerprint classifications, tarpit templates, route strategy, fake data, payloads, challenge behavior, ML settings, and 
- [Module veilgate_tarpit](https://veilgate.dev/docs/functionalities/tarpit-content.md) - The veilgate tarpit module serves deterministic fake application responses to requests that cross the tarpit threshold. It combines per client fake profiles, route strategy, response templates, and payload injection.
- [Module veilgate_tarpit](https://veilgate.dev/docs/functionalities/tarpit-handler.md) - The veilgate tarpit module serves deterministic fake application responses to requests that cross the tarpit threshold. It combines per client fake profiles, route strategy, response templates, and payload injection.
- [Module veilgate_tls_fingerprinting](https://veilgate.dev/docs/functionalities/tls-fingerprinting.md) - The veilgate tls fingerprinting module captures TLS ClientHello data and classifies clients using JA3 and JA4 fingerprints. It contributes detector signals such as tls agent, tls bot, and tls non browser.
- [Upload Policies](https://veilgate.dev/docs/functionalities/upload-policies.md) - VeilGate's upload policy layer protects known file upload endpoints without turning the proxy into a file scanner. Operators explicitly name upload paths such as /api/upload/ , then VeilGate applies method, declared body
- [WebSocket and gRPC Proxying](https://veilgate.dev/docs/functionalities/websocket-grpc-proxy.md) - VeilGate proxies WebSocket upgrades and gRPC streams in addition to plain HTTP. Both protocols run through the full scoring and decision pipeline before being routed; the difference is in how the response is shaped when 
- [How-to guides](https://veilgate.dev/docs/how-to/README.md) - Task oriented walk throughs. Each page solves one specific problem an operator hits during install or day 2 ops.
- [How to set up API blueprinting](https://veilgate.dev/docs/how-to/api-blueprint.md) - Goal: Tell VeilGate which paths your application actually serves so it can fire the api blueprint miss signal whenever a client probes a path that is not in your documented API — a common recon pattern before an attack.
- [Cloudflare + VeilGate Setup](https://veilgate.dev/docs/how-to/cloudflare-setup.md) - Cloudflare sits in front of many production APIs. This guide explains how to configure Cloudflare and VeilGate together correctly, what you gain and what you lose at each SSL/TLS mode, how to issue and install an Origin 
- [How to investigate attacks with endpoint correlation](https://veilgate.dev/docs/how-to/endpoint-correlation.md) - Goal: Use VeilGate's endpoint correlation metrics to answer "which endpoints are under attack, what kind of attack, and how severe?" — without grep ing logs.
- [How to handle a Right-to-Erasure (RTBF) request](https://veilgate.dev/docs/how-to/handle-rtbf.md) - Goal: Delete every record VeilGate persisted about a specific client identifier (typically an IP address), produce an audit trail entry for the deletion, and confirm no in memory state survives.
- [How-to: Install Community Rules](https://veilgate.dev/docs/how-to/install-community-rules.md) - This guide covers installing, updating, and managing community detection rules from the veilgate rules repository.
- [How to install VeilGate on Linux](https://veilgate.dev/docs/how-to/install-on-linux.md) - Goal: End up with VeilGate running as a hardened systemd service on a fresh Ubuntu / Debian / RHEL host, with the proxy on :8080 and private metrics on 127.0.0.1:9090.
- [JA3 / JA4 TLS Fingerprinting](https://veilgate.dev/docs/how-to/ja3-ja4-fingerprinting.md) - TLS fingerprinting is one of the strongest signals in VeilGate's detector stack. A human visiting your site in Chrome produces a very different TLS ClientHello than a Python requests script or a nuclei scanner — and that
- [How to monitor VeilGate with Prometheus and Grafana](https://veilgate.dev/docs/how-to/monitor-with-prometheus.md) - Goal: Move from the live dashboard at :9090/ to a real time series view with Prometheus retention and Grafana visualisation.
- [How to roll out observe mode and tune thresholds](https://veilgate.dev/docs/how-to/observe-and-tune.md) - Goal: Move from "VeilGate is running" to "VeilGate is making correct decisions on my real traffic" without ever returning a wrong response to a real user.
- [How to set up OpenTelemetry observability](https://veilgate.dev/docs/how-to/opentelemetry.md) - Goal: Ship VeilGate request traces, structured logs, and metrics to a collector (SigNoz, Grafana, Honeycomb, Jaeger) so you can inspect individual scored requests, see which signals fired on each, filter by attack family
- [How to promote learned rules](https://veilgate.dev/docs/how-to/promote-learned-rules.md) - Goal: Take the (feature, bucket) candidates the ML miner has proposed and turn the high confidence ones into active detection rules — without ever auto promoting on production.
- [Protect an SPA + API on different subdomains](https://veilgate.dev/docs/how-to/protect-multi-origin.md) - Audience: Operators putting veilgate in front of an HTTP API consumed by a single page application hosted on a different subdomain. e.g.: app.example.com (SPA on CDN) → api.example.com (behind veilgate).
- [Authenticate server-to-server callers with HMAC](https://veilgate.dev/docs/how-to/server-to-server-hmac.md) - Audience: Operators with internal services, partner webhooks, or native mobile apps that need to reach a veilgate protected API without solving a JavaScript proof of work.
- [Setup: Same-origin (frontend + API on one server)](https://veilgate.dev/docs/how-to/setup-same-origin.md) - When to use this: Your backend serves both the SPA bundle and the API from the same host. VeilGate sits in front of everything on one origin.
- [Setup: Server-to-server (HMAC)](https://veilgate.dev/docs/how-to/setup-server-to-server.md) - When to use this: A backend service, cron job, mobile app, or CLI tool needs to call a VeilGate protected API. There is no browser and no JavaScript runtime to solve a proof of work challenge.
- [Setup: SPA on CDN + API behind VeilGate](https://veilgate.dev/docs/how-to/setup-spa-cdn.md) - When to use this: Your frontend (React, Vue, Svelte, etc.) is hosted on a CDN — Vercel, Netlify, AWS CloudFront, Oracle CDN, or any static host — and your API runs on a separate host behind VeilGate.
- [Server-to-Server: Calling the ShopStorm API](https://veilgate.dev/docs/how-to/shopstorm-api-server-to-server.md) - Demo API base URL: https://demo api.veilgate.dev OpenAPI spec: shopstorm/openapi.yaml in the demo repo
- [TLS Setup](https://veilgate.dev/docs/how-to/tls-setup.md) - VeilGate must terminate TLS itself to compute JA3 and JA4 fingerprints. When your edge layer (CDN, load balancer) terminates TLS before VeilGate, the raw ClientHello is consumed upstream and those fingerprint signals go 
- [Use The Admin Dashboard](https://veilgate.dev/docs/how-to/use-admin-dashboard.md) - This guide walks through day to day use of the VeilGate admin dashboard after the proxy is installed or running locally.
- [Internals](https://veilgate.dev/docs/internals/README.md) - These pages map documented behavior back to the Go implementation.
- [VeilGate Code Map](https://veilgate.dev/docs/internals/code_map.md) - This page maps documentation modules to implementation packages. Use it when a configuration field needs to be traced from YAML to runtime behavior.
- [Codebase Coverage Matrix](https://veilgate.dev/docs/internals/coverage_matrix.md) - This matrix maps every top level command and internal package to the documentation page that explains its behavior. Use it as a coverage checklist when adding code or changing runtime behavior.
- [Decision Flow](https://veilgate.dev/docs/internals/decision_flow.md) - This page maps the proxy decision path to code.
- [Detector Signal Flow](https://veilgate.dev/docs/internals/detector_signal_flow.md) - This page maps every detector signal to its implementation in internal/detector/scorer.go, its default weight, the rule file that controls it, and the conditions under which it fires.
- [Engineering Gaps](https://veilgate.dev/docs/internals/engineering-gaps.md) - Companion to the business case. Where the case study asks "should we?", this document answers "what's done, what's deferred, and what would the next pass look like?".
- [Persistence Flow](https://veilgate.dev/docs/internals/persistence_flow.md) - This page documents the SQLite event store implemented in internal/persist. The store serves three consumers: the operator (audit, review), the ML pipeline (feature rollups, weak label training), and the detector (canary
- [Tarpit Rendering Flow](https://veilgate.dev/docs/internals/tarpit_rendering_flow.md) - This page documents the internal pipeline that transforms an inbound high confidence request into a deterministic fake application response. The pipeline is implemented by internal/tarpit and is invoked when the proxy de
- [Operator And Test Tooling](https://veilgate.dev/docs/internals/tooling.md) - This page documents the helper commands under cmd/. These binaries are not request path modules, but they are part of the operational surface of the codebase and are useful for validation, replay, and ML smoke testing.
- [Model Card](https://veilgate.dev/docs/model/README.md) - VeilGate includes online ML assisted scoring. The ML signal is one input to the overall detector; it is not the only decision maker.
- [VeilGate Module Reference](https://veilgate.dev/docs/modules/README.md) - The pages in this directory use a reference style structure: module purpose, example configuration, directive list, syntax/default/context blocks, implementation code path, operational notes, validation commands, and lim
- [Module veilgate_audit](https://veilgate.dev/docs/modules/veilgate_audit.md) - The veilgate audit module records operator and system actions in a hash chained audit log. It also documents the veilgate forget command, which deletes persisted rows for a client identifier and records the deletion.
- [Module veilgate_capture](https://veilgate.dev/docs/modules/veilgate_capture.md) - The veilgate capture module writes one JSONL record for each scored request. It is useful for legacy pipelines, traffic review, and training data export. For normal operations, the SQLite persistence module is usually pr
- [Module veilgate_challenge](https://veilgate.dev/docs/modules/veilgate_challenge.md) - The veilgate challenge module serves proof of work (PoW) challenges for requests that are suspicious but not high confidence tarpit traffic. When a client's score meets score challenge threshold, VeilGate returns an HTML
- [Module veilgate_core](https://veilgate.dev/docs/modules/veilgate_core.md) - The veilgate core module describes the top level runtime fields that decide where VeilGate listens, which upstream application receives clean traffic, which operating mode is active, and where external rule files are loa
- [Module veilgate_detector](https://veilgate.dev/docs/modules/veilgate_detector.md) - The veilgate detector module calculates a score for each request using request shape, path and payload indicators, network reputation, protocol fingerprints, rolling client history, deception feedback, and optional ML.
- [Module veilgate_http2_fingerprinting](https://veilgate.dev/docs/modules/veilgate_http2_fingerprinting.md) - The veilgate http2 fingerprinting module models HTTP/2 SETTINGS fingerprints and exposes them to the detector as protocol level signals. It is separate from TLS fingerprinting: JA3/JA4 describes the TLS ClientHello, whil
- [Module veilgate_metrics](https://veilgate.dev/docs/modules/veilgate_metrics.md) - The veilgate metrics module exposes Prometheus metrics and the built in dashboard. It is served by a separate HTTP server from the proxy listener.
- [Module veilgate_ml](https://veilgate.dev/docs/modules/veilgate_ml.md) - The veilgate ml module documents optional online ML scoring and rule mining. ML is an additive detector signal, not the primary enforcement engine. The deterministic rules and thresholds still control final routing. When
- [Module veilgate_persistence](https://veilgate.dev/docs/modules/veilgate_persistence.md) - The veilgate persistence module documents the SQLite backed event store. It records request events, feature rollups, learned rule candidates, audit entries, and tarpit canary state.
- [Module veilgate_proxy](https://veilgate.dev/docs/modules/veilgate_proxy.md) - The veilgate proxy module documents how VeilGate acts as a reverse proxy, resolves client identity, applies the mode and threshold decision function, dispatches to the correct handler, and protects detector state from sp
- [Module veilgate_rules](https://veilgate.dev/docs/modules/veilgate_rules.md) - The veilgate rules module documents external YAML rule files. These files define detector weights, fingerprint classifications, tarpit templates, route strategy, fake data, payloads, decoy paths, challenge behavior, ML s
- [Module veilgate_tarpit](https://veilgate.dev/docs/modules/veilgate_tarpit.md) - The veilgate tarpit module serves deterministic fake application responses to requests that cross the tarpit threshold. It combines per client fake profiles, route strategy, response templates, and payload injection.
- [Module veilgate_tls_fingerprinting](https://veilgate.dev/docs/modules/veilgate_tls_fingerprinting.md) - The veilgate tls fingerprinting module captures TLS ClientHello data and classifies clients using JA3 and JA4 fingerprints. It contributes detector signals such as tls agent, tls bot, and tls non browser.
- [Module veilgate_verifier](https://veilgate.dev/docs/modules/veilgate_verifier.md) - The veilgate verifier module documents optional request verifier chains. The current implemented verifier is HMAC SHA256, following the Stripe webhook signature pattern. A successful verifier result upgrades a challenge 
- [Operations](https://veilgate.dev/docs/operations/README.md) - This guide covers metrics, dashboards, routine checks, and common tuning tasks.
- [Admin Dashboard Security And Private Access](https://veilgate.dev/docs/operations/admin-dashboard-security.md) - The admin dashboard can edit veilgate.yaml, rule files, detection signals, OpenAPI blueprints, decoy endpoints, and credentials. Treat it like a production control plane. The recommended posture is:
- [Admin Dashboard Operations](https://veilgate.dev/docs/operations/admin-dashboard.md) - This page covers deployment, hardening, backup, monitoring, and troubleshooting for the VeilGate admin dashboard.
- [Prometheus Query Cookbook](https://veilgate.dev/docs/operations/prometheus-queries.md) - This page collects common PromQL queries for VeilGate operations. The metrics are emitted by internal/telemetry and exposed on the listener configured by metrics.listen.
- [Rollout Guide](https://veilgate.dev/docs/operations/rollout.md) - This page covers the recommended sequence for deploying VeilGate in front of a production application. The sequence is designed to minimize false positives and allow the operator to build confidence in the detector befor
- [Security Hardening](https://veilgate.dev/docs/operations/security_hardening.md) - This page lists security controls and configuration choices that must be reviewed before deploying VeilGate in an enforcement capable mode (challenge, tarpit, or auto).
- [Troubleshooting](https://veilgate.dev/docs/operations/troubleshooting.md) - This page covers diagnostic steps for common operational problems. For each issue, follow the checklist in order before changing configuration.
- [Reference](https://veilgate.dev/docs/reference/README.md) - Use this section when you need lookup oriented documentation rather than a step by step guide.
- [Admin Dashboard Reference](https://veilgate.dev/docs/reference/admin-dashboard-reference.md) - This page is the lookup reference for the admin dashboard: command line flags, routes, API endpoints, files, authentication behavior, and implementation paths.
- [@veilgate/client — browser SDK](https://veilgate.dev/docs/reference/clients/browser.md) - The browser side companion package for VeilGate. Add two lines to your SPA and all fetch requests automatically:
- [@veilgate/node — server-side SDK](https://veilgate.dev/docs/reference/clients/node.md) - Node.js helper for server to server calls to a VeilGate protected API. Provides two authentication modes:
- [Configuration Reference](https://veilgate.dev/docs/reference/config-reference.md) - VeilGate reads one YAML file at startup. The default path is:
- [/_g/start](https://veilgate.dev/docs/reference/endpoints/start.md) - The PoW interstitial endpoint. Serves a self contained HTML page that solves the proof of work challenge in the browser and postMessages the resulting token back to the parent window. Designed to be loaded in a hidden <i
- [/_g/config](https://veilgate.dev/docs/reference/endpoints/well-known.md) - The discovery endpoint. Returns a JSON document that describes the current VeilGate configuration — which challenge flow is active and which credential shapes are accepted. A browser SDK or server client calls this once 
- [veilgate functionality reference](https://veilgate.dev/docs/reference/functionality-reference.md) - Every knob, signal, and subsystem in veilgate, with three things for each: how it works , how to enable it in veilgate.yaml , and what changes at runtime when you do .
- [Bearer Verifier](https://veilgate.dev/docs/reference/verifiers/bearer.md) - The bearer verifier accepts opaque static tokens carried in a request header. A valid token short circuits the score/challenge tier — the request is treated as real without solving a PoW.
- [HTTP Callout Validator](https://veilgate.dev/docs/reference/verifiers/callout-validator.md) - The callout validator delegates credential validation to an operator supplied HTTP endpoint and caches affirmative responses. It is used by the cookie verifier and the header verifier when neither a static opaque value n
- [Cookie Verifier](https://veilgate.dev/docs/reference/verifiers/cookie.md) - The cookie verifier accepts a request when a named cookie carries a value that the configured validator approves. It is the bridge between operator owned session systems (SSO, internal auth, CDN set JWTs) and VeilGate's 
- [Header Verifier](https://veilgate.dev/docs/reference/verifiers/header.md) - The header verifier accepts a request when a named request header carries a value the configured validator approves. It is the header shaped sibling of the cookie verifier and shares the same validator surface — switchin
- [JWT Validator](https://veilgate.dev/docs/reference/verifiers/jwt-validator.md) - The JWT validator verifies a signed JSON Web Token against a JWKS published public key set, then asserts standard claims (iss, aud, exp, nbf) and extracts a client identifier from a configured claim. It is used by the co
- [Use Cases](https://veilgate.dev/docs/usecases/README.md) - VeilGate is a single host reverse proxy that detects and tarpits AI driven pentest agents. The deployment shape is always the same — a hardened systemd service in front of an upstream application. What changes is the ope
- [Use case: API recon blocking](https://veilgate.dev/docs/usecases/api-recon-blocking.md) - Summary: Public APIs attract continuous automated discovery — schema probing, parameter enumeration, IDOR walking. VeilGate tags this traffic via per IP fan out, path bruteforce, and toolchain signals, then diverts repea
- [Use case: Bug-bounty noise reduction](https://veilgate.dev/docs/usecases/bug-bounty-triage.md) - Summary: Bug bounty programs in 2026 receive a flood of submissions generated by autonomous AI agents — often with a fluent narrative attached but no actual vulnerability behind them. VeilGate tags traffic as agent drive
- [Use case: Compliance & audit evidence](https://veilgate.dev/docs/usecases/compliance-evidence.md) - Summary: Security and audit committees in 2026 increasingly ask for a documented "AI threat exposure" answer. VeilGate produces durable evidence — telemetry, an audit log, a model card, and a deletion primitive — that ma
- [Use case: LLM-agent defence](https://veilgate.dev/docs/usecases/llm-agent-defense.md) - Summary: When the threat model is autonomous AI pentest agents (Strix, HexStrike, PentAGI, CAI, PentestGPT, Claude Code on a leash), VeilGate runs in tarpit mode and actively burns the attacker's LLM token budget. This i
- [Use case: Replace your WAF with VeilGate](https://veilgate.dev/docs/usecases/replace-your-waf.md) - Summary: Traditional WAFs block on known signatures — they reject requests that look like CVE YYYY NNNN. VeilGate scores on behaviour — it identifies that a client is acting like an automated scanner before it finds anyt

## Licensing

VeilGate core is Apache-2.0. veilgate-rules is MIT licensed.