What Is Runtime Application Security?
Runtime application security enforces controls while the application runs, at the point untrusted input meets your code, with context that pre- and post-runtime tools do not have.
Read guideWeb Security
Runtime security guides
Enforcing security decisions while the application runs, in the path of the action, with application context.
What these guides cover
Runtime security enforces policy while an application is executing, at the moment untrusted input reaches code or an action is about to take effect. It is distinct from pre-deployment scanning, which never sees live input, and from monitoring, which reports after the fact. The defining property is that a decision arrives before the effect: the application receives an allow, block, redact, or limit result and branches on it. Effective runtime controls need both speed and context, because a decision in the request path must be fast enough to keep, and a decision worth making requires knowing the user, the route, the target object, and the operation. Controls must also define explicit behavior when a security dependency is slow or unavailable, per action rather than globally.
Risks
- Attacks arriving in live traffic that pre-deployment testing cannot see
- Authorization decisions made without user or object context
- Consequential actions on paths that never cross the network perimeter
- Controls that fail open silently or fail closed indiscriminately
Control priorities
- Enforcement in application code, in the path of the action
- Decisions using authenticated identity, route, object, and tenant
- Coverage of tool calls, queue consumers, and background jobs
- Dry-run measurement and per-action failure behavior
Recommended reading order
Start with runtime application security for the definition, lifecycle position, and comparison against network and gateway controls. Use pre-runtime vs post-runtime tooling to separate detection from enforcement when evaluating vendors, then read the LLM runtime security guide for AI-specific failure modes and the local inspection guide for data residency.
Guides in this collection
SDK-based security vs WAF vs API gateway
SDK-based security vs WAF vs API gateway: what each layer sees, why indie teams import a library instead of pointing DNS at Cloudflare, and how to add bots, rate limits, and attack blocking in a few lines of code.
Read guideHow to Enforce Security Rules at Runtime in Your Code
The rule ships with the feature and runs in the request path. How in-code enforcement works, and how to roll it out safely.
Read guideHow do I detect and block attacks at runtime?
Detect injection, abuse, exfiltration, and agent manipulation in the handler, then deny before the query, the charge, or the model. Keep the body in process.
Read guideAre Next.js server actions a security risk?
Are Next.js server actions a security risk? Treat them as public HTTP APIs: validate on the server and call protect() before you write to the database.
Read guideWere you affected by the Next.js middleware bypasses?
Were you affected by the Next.js middleware bypasses? Patch CVE-2025-29927, search logs for x-middleware-subrequest, and put authorization in the handler.
Read guideHow do you prevent SQL injection and XSS in Node.js?
Prevent SQL injection and XSS in Node.js with parameterized queries, output escaping, Node.js 22 LTS, and Arcjet Shield on the request handler.
Read guideDoes Next.js need a WAF?
Does Next.js need a WAF? Yes, for scanners, known CVEs, and PCI DSS 4.0. Prefer an in-app Shield rule you can dry-run behind your existing CDN.
Read guideWhat is permissions-based security in Next.js?
Permissions-based security in Next.js: authentication names the user, Permit.io authorizes the object, and Arcjet stops attacks and abuse on the request.
Read guide