Why Traditional WAFs Fail
A traditional firewall looks for strings like `SELECT * FROM`. An attacker knows this, so they send `%53%45%4C%45%43%54` (URL encoded), or worse, they use Unicode homoglyphs that look like English letters but aren't. If your security tool only sees the encoded version, the attack sails through.
Inside the 1-SEC Normalizer
Before we even check for threats, we "normalize" every piece of input through 8 distinct phases.
Phase 1-3: Decoding & De-obfuscation
We handle URL encoding, Base64, and Hex encoding recursively. If an attacker triple-encodes a payload, 1-SEC peels it all back until the raw intent is revealed.
Phase 4-6: Canonicalization
We resolve weird pathing like `../../` and handle null-byte injections. We also normalize Unicode to ensure that a "fake" 'a' (like the Cyrillic 'а') is treated as its Latin equivalent for detection purposes.
Phase 7-8: Structural Analysis
Finally, we strip non-functional whitespace and comments that are specifically designed to break regex patterns. By the time the input reaches our detection engine, it is "naked," and the attack is obvious.