UNIVERSAL WEB SHIELD / POLICY INSTRUMENT

One security boundary. Every site you run.

One auditable policy that emits protection for static sites, Node/Express, Next.js and Cloudflare Workers. AI crawler governance, request validation, security headers, rate limits and injection detection — with identical verdicts across every runtime.

Runs locally · never mutates production · no DNS or secrets · reproducible verdicts

Four verdicts, one reason code

Every request gets one explicit action and a stable machine-readable reason code. Not a black-box score — you can inspect why, reproduce it, and roll it back.

allowPass through, no friction
observeAllow but log — for tuning
challengeRequire verification
blockDeny with a generic response
Static _headersNode / ExpressNext.js middleware Cloudflare WorkersNginx includerobots.txt + llms.txt

Seven boundaries

Each one can be toggled, tested and rolled back on its own.

01
Request boundary

Method, path, body size, content-type and host validation

02
Browser boundary

CSP, HSTS, frame, MIME, referrer and permissions policies

03
Identity boundary

CSRF, origin checks, login throttling and generic failure responses

04
Abuse boundary

IP/key rate limits, burst control, route budgets and evidence-safe logging

05
AI boundary

Named crawler policy, sensitive-route denial, training vs search distinction, robots/llms guidance

06
Injection boundary

Traversal, SQLi, XSS, command-injection and prompt-injection signals

07
Supply-chain boundary

Lockfile/dependency audit commands and secret-safe configuration

AI crawlers: four postures, your call

Most anti-bot tools block the AI search crawlers that actually send you traffic. TJ Sentinel separates training crawls from search indexing — the policy is explicit and reversible.

open

Everything passes. For content sites that want maximum AI citation.

search-only

Allow search indexing, deny training crawls. When you want the traffic but not the training set.

verified-only

Only named crawlers from verifiable sources; spoofed user agents fall back to ordinary traffic rules.

closed

Deny all, still with explicit reason codes so you can reopen later.

What it does not do — stated here, not buried in the fine print

  • No claim of blocking every attacker, zero-days, compromised admin accounts or upstream outages.
  • No CAPTCHA bypass, fingerprint evasion, offensive exploitation, or automated production mutation.
  • No silent blocking of useful AI search crawlers — the policy stays explicit and reversible.
  • Audit logs never store raw passwords, tokens, full request bodies or personal data.

Frequently asked questions

How is this different from a WAF?

A WAF runs at your infrastructure edge with vendor rule sets you cannot reproduce. TJ Sentinel is a policy file you own: it generates runtime-specific protection locally, and the same request yields the same verdict and reason code across all four runtimes — so it can live in version control, be code-reviewed and rolled back.

Will it block Google or ChatGPT and cost me traffic?

Not by default. The AI posture defaults to search-only: search indexing crawlers that send you traffic are allowed, and only training crawls are denied. You explicitly choose among open, search-only, verified-only and closed, and can change it at any time.

Which stacks are supported?

Static sites (_headers), Node/Express middleware, Next.js middleware, Cloudflare Workers/Pages, plus Nginx include and robots.txt / llms.txt generation. All adapters return identical verdicts on the same fixture set.

Does installing it touch my production environment?

No. Policy generation and attack simulation run entirely locally; production deployment, DNS changes and credential handling stay outside the generator and remain yours to execute. The recommended flow is to install into an isolated copy of the site and run the bundled verification probes before going live.

When something is blocked, how do I find out why?

Every block carries a stable machine-readable reason code (for example sqli.union_select) plus a correlation ID. The public response stays generic while detailed, redacted evidence remains local — so you can debug without leaking rule details to attackers.

Run it against an isolated copy first. Decide afterwards.

Pick your stack, pick an AI posture, generate the bundle, simulate legitimate and hostile requests, then verify in an isolated copy. None of it touches production.

Request access