Architecture

How Silker works

Silker inspects traffic where your app runs and blocks threats in real time. Detection runs on your own infrastructure - we only receive sanitized security events.

Request flow
Incoming request
user / attacker / bot
Silker inspects
runs on your infra
Legitimate → your app
Malicious → 403 blocked
Sanitized security events stream to your dashboard - your traffic never passes through our servers.
Prompt injection & jailbreaks on your LLM routes
Sensitive data & secrets leaking out (DLP)
API abuse, brute force & rate-limit violations
OWASP basics: SQLi, XSS, path traversal, file-upload abuse

Three ways to deploy the guard

Same detection engine. Where it sits depends on where your app runs.

Node.js SDK

Apps with a server

One line in Next.js, Express or any Node backend. Silker runs inside your app and blocks threats locally, before they reach your model or database.

Best for: Cursor / Claude Code / Bolt full-stack / Replit

Cloudflare Worker

No code changes

Deploy a Worker on your Cloudflare zone. Traffic is inspected at the edge before it hits your app - no changes to your codebase.

Best for: Any app behind a custom domain

Docker proxy

Self-host · any stack

Run the proxy in front of any backend - PHP, Java, Python, Go. Point your traffic at it. No Cloudflare required.

Best for: Self-hosted / regulated environments

Apps with no backend (browser → Supabase)

Some AI-built apps talk to Supabase directly from the browser, with no server in between. There is no place to put an inline guard there - and blocking in the browser can be bypassed. For those apps the honest answer is different: we lock the database down (Row-Level Security) and monitor access, rather than pretend to block live. We'll always tell you which protection actually applies to your setup.

Traffic stays with you

Detection runs in your runtime or your edge. Your requests never route through our servers.

Only events leave

We receive sanitized security events (what was blocked and why) - not your users' payloads.

PII redacted first

Sensitive data is redacted before anything is logged or sent.