# Coraza - **Canonical URI:** https://www.vioscale.ai/software/coraza - **Category:** WAF - **Homepage:** https://coraza.io/ - **Also known as:** coraza - **Profile claimed by vendor:** no - **Last updated:** 2026-08-26T19:32:02.450Z ## Vioscale score **46.1 / 100**, confidence 32% (low). Computed 2026-09-01. Composite of weighted, independently-sourced signals (no user reviews, no vendor payment). | Signal | Score | Weight | Contribution | Evidence present | |---|--:|--:|--:|:--:| | price_level | 100 | 0.052 | 5.2 | ✓ | | reliability | 0 | 0.073 | 0 | - | | capabilities | 0 | 0.084 | 0 | - | | repo_stars | 67.4 | 0.026 | 1.8 | ✓ | | integrations | 17.3 | 0.09355555555555557 | 1.6 | ✓ | | dependent_projects | 20.5 | 0.063 | 1.3 | ✓ | | dev_activity | 34 | 0.094 | 3.2 | ✓ | | release_cadence | 82.8 | 0.052 | 4.3 | ✓ | | security_posture | 0 | 0.073 | 0 | - | | package_downloads | 0 | 0.136 | 0 | - | | security_score | 93 | 0.042 | 3.9 | ✓ | | pricing_transparency | 25 | 0.084 | 2.1 | ✓ | | community_qa_activity | 0 | 0.063 | 0 | - | ## Pricing _As of 2026-08-19, [verify at source](https://coraza.io/). Independently observed._ Open source · Free tier > Free and open source ## About A web application firewall that provides enterprise-grade threat protection for APIs, applications, and legacy systems, with minimal performance overhead and support for custom rules and integrations. _Independently observed._ ## Platform & deployment - **Deployment:** Self-hosted ## Integrations (3) _Independently observed._ - NGINX - Envoy - Apache APISIX ## Release history | Version | Date | Type | |---|---|---| | [v3.7.0](https://github.com/corazawaf/coraza/releases/tag/v3.7.0) | 2026-04-06 | stable | | [v3.6.0](https://github.com/corazawaf/coraza/releases/tag/v3.6.0) | 2026-03-31 | stable | | [v3.5.0](https://github.com/corazawaf/coraza/releases/tag/v3.5.0) | 2026-03-28 | stable | | [v3.4.0](https://github.com/corazawaf/coraza/releases/tag/v3.4.0) | 2026-03-11 | stable | | [v3.3.3](https://github.com/corazawaf/coraza/releases/tag/v3.3.3) | 2025-03-20 | stable | | [v3.3.2](https://github.com/corazawaf/coraza/releases/tag/v3.3.2) | 2025-01-09 | stable | | [v3.3.1](https://github.com/corazawaf/coraza/releases/tag/v3.3.1) | 2025-01-07 | stable | | [v3.3.0](https://github.com/corazawaf/coraza/releases/tag/v3.3.0) | 2025-01-03 | stable | | [v3.2.1](https://github.com/corazawaf/coraza/releases/tag/v3.2.1) | 2024-06-23 | stable | | [v3.2.0](https://github.com/corazawaf/coraza/releases/tag/v3.2.0) | 2024-06-20 | stable | | [v3.1.0](https://github.com/corazawaf/coraza/releases/tag/v3.1.0) | 2024-02-09 | stable | | [v3.0.4](https://github.com/corazawaf/coraza/releases/tag/v3.0.4) | 2023-09-26 | stable | | [v3.0.3](https://github.com/corazawaf/coraza/releases/tag/v3.0.3) | 2023-08-06 | stable | | [v3.0.2](https://github.com/corazawaf/coraza/releases/tag/v3.0.2) | 2023-06-27 | stable | | [v3.0.1](https://github.com/corazawaf/coraza/releases/tag/v3.0.1) | 2023-06-25 | stable | _… and 5 earlier release(s)._ ## Security & compliance Known vulnerabilities: 2 (0 in the last 12 months), max severity HIGH ([source](https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fcorazawaf%2Fcoraza%2Fv3&per_page=100)). A count reflects scale and disclosure, not quality. ## Facts Every value below carries its source and our confidence. Facts are re-crawled on a freshness schedule. ### integrations | Attribute | Value | Source | Retrieved | Confidence | |---|---|---|---|---| | integrations.count | 3 | [link](https://coraza.io/) | 2026-08-19 | 60% (medium) | ### pricing | Attribute | Value | Source | Retrieved | Confidence | |---|---|---|---|---| | pricing.free_tier | yes | [link](https://coraza.io/) | 2026-08-19 | 60% (medium) | | pricing.price_level | free | [link](https://coraza.io/) | 2026-08-19 | 60% (medium) | | pricing.model | commercial | [link](https://coraza.io/) | 2026-08-26 | 40% (low) | ### activity | Attribute | Value | Source | Retrieved | Confidence | |---|---|---|---|---| | activity.commits_last_30d | 11 | [link](https://github.com/corazawaf/coraza/pulse) | 2026-08-26 | 65% (medium) | ### adoption | Attribute | Value | Source | Retrieved | Confidence | |---|---|---|---|---| | adoption.github_stars | 3,761 | [link](https://github.com/corazawaf/coraza) | 2026-08-26 | 90% (high) | | adoption.dependent_repos | 16 | [link](https://packages.ecosyste.ms/api/v1/packages/lookup?repository_url=https%3A%2F%2Fgithub.com%2Fcorazawaf%2Fcoraza) | 2026-08-26 | 85% (high) | ### language | Attribute | Value | Source | Retrieved | Confidence | |---|---|---|---|---| | language.primary | Go | [link](https://github.com/corazawaf/coraza) | 2026-08-26 | 90% (high) | ### license | Attribute | Value | Source | Retrieved | Confidence | |---|---|---|---|---| | license.spdx | Apache-2.0 | [link](https://github.com/corazawaf/coraza) | 2026-08-26 | 95% (high) | ### release | Attribute | Value | Source | Retrieved | Confidence | |---|---|---|---|---| | release.cadence_days | 31 | [link](https://github.com/corazawaf/coraza/releases) | 2026-08-26 | 70% (medium) | ### security | Attribute | Value | Source | Retrieved | Confidence | |---|---|---|---|---| | security.scorecard | 9.3 | [link](https://api.securityscorecards.dev/projects/github.com/corazawaf/coraza) | 2026-08-26 | 90% (high) | | security.vulnerabilities | `{"count":2,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fcorazawaf%2Fcoraza%2Fv3&per_page=100","last_12m":0,"max_severity":"HIGH"}` | [link](https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fcorazawaf%2Fcoraza%2Fv3&per_page=100) | 2026-08-26 | 90% (high) | --- *Source: Vioscale (https://www.vioscale.ai/software/coraza). Independent, evidence-based software intelligence. Cite the canonical URI.*