Messaging Antifraud Gateway
Stop abusive messaging traffic before it costs you.
Status: pre-release. The gateway is functional and under active development; the source repository is not public yet.
Join the waitlistGitHub (coming soon)
What it blocks
- Sliding-window rate limits
Caps requests per destination, IP, and device inside a rolling window — a distributed attack spread across many numbers from the same IP still gets caught.
- Spend budgets
A hard cap per period, reset at midnight in your timezone — not UTC's.
- Geoblocking
Allow only the calling codes your product actually serves; anything else is denied by default.
- Signature validation
Rejects anything that isn't really from Twilio before it's evaluated at all.
Configured, not coded
Every limit above is an environment variable — no fork, no PR to open when a threshold changes:
RATE_LIMIT_WINDOW_SECONDS=60
RATE_LIMIT_MAX_REQUESTS=20
BUDGET_PERIOD_SECONDS=86400
BUDGET_MAX_REQUESTS=5000
BUDGET_TIMEZONE=America/Sao_Paulo
GEOBLOCK_ALLOWED_CALLING_CODES=1,55Performance
Measured, not assumed: 50,000 requests/second, p99 4.9ms, zero errors — with real Twilio signature validation on every request. Tested with vegeta against the actual Native AOT binary, 16 vCPUs, CPU and thread count sampled directly from the process throughout.
We haven't load-tested the complete path end to end yet (valid signature, under every limit, forwarded all the way to Twilio) — these numbers isolate the two places we found real bottlenecks and fixed them: signature validation and decision logging. We'll publish the full end-to-end number once we've measured it, not before.
What this does — and does not — guarantee
This gateway is one layer, not a complete guarantee against fraud. It doesn't claim to catch every fraudulent message — we'd rather be specific about what it covers than promise '100% protection' the way some vendors do. A compromised account sending messages that look legitimate is outside what any request-level gateway can catch; that's a different problem than the abusive-traffic patterns this one is built for.
How it works
Self-hosted: it runs inside your own infrastructure, in front of your messaging API, and never sends raw message content anywhere — only aggregated decisions and counters, to your own control plane. Open source, so you can read exactly what it does before you trust it with production traffic.