Arcjet
Developer-first security that ships with your code: bots, rate limits, and WAF.
About
Arcjet is a security platform designed to live inside application code rather than as a separate appliance or reverse proxy. Developers call its SDK from their request handlers to get bot detection, rate limiting, email validation, sensitive information detection, and Shield WAF protection against OWASP Top 10 attacks, with rules configured in code.
Founded in 2023 by David Mytton (previously Server Density and console.dev), Arcjet raised an $8.3M Series A in October 2025 led by Plural and Ott Kaukver, bringing total funding to $12M with participation from Andreessen Horowitz and Seedcamp. In the same announcement it launched a local AI attack-detection model that runs inside the request handler, analyzing user behavior alongside business context. The company reports more than 1,000 developers protecting 500+ production applications. It supports Node.js, Bun, and Deno runtimes plus Next.js, Remix, SvelteKit, NestJS, and other frameworks.
What it can do
- Bot detection and AI-powered attack detection running locally in code
- Rate limiting and Shield WAF against OWASP Top 10 attacks
- Email validation and sensitive information detection
- Framework adapters for Next.js, Remix, SvelteKit, NestJS, and more
Setup
Sign up free at arcjet.com, install the SDK (npm i @arcjet/node), add your site key, and wrap your routes with protect() calls.
Prerequisites
A JavaScript/TypeScript app on Node.js, Bun, or Deno; an Arcjet site key.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 98; Trending score 84/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.