SignalFence

Why SignalFence

A firewall can stop an attack. It can also stop a paying customer at checkout. Alert on every denied request and the inbox becomes a second denial of service.

SignalFence makes a simpler promise. Routine firewall noise stays quiet. Patterns that deserve attention open a short evidence view for a human.

What the demo shows

The zero setup demo replays three synthetic outcomes. It groups 300 routine probes into one quiet cluster, flags blocked checkout traffic for false positive review, and turns distributed login automation into one compact credential stuffing review.

Choose a scenario to see the cited log fields, hashed client fingerprints, action counts, verification steps, and a draft next action. SignalFence never changes or deploys firewall rules.

How it stays trustworthy

The fixtures follow the official Vercel Log Drain event shape and contain no real people, domains, or IP addresses. The parser accepts JSON or NDJSON and hashes client IPs before events reach the interface. Deterministic TypeScript owns clustering and the demo review priority.

GPT-5.6 Sol was used through Codex CLI to turn sanitized cluster summaries into readable explanations. Each result must match a strict JSON Schema and pass evidence checks against a deterministic catalog. The model explains the evidence. It never decides whether to block traffic or change infrastructure.

How Codex helped

Codex supported the document review, architecture, implementation, fixture generation, tests, browser checks, and pull request workflow. The finished demo runs without an API key or account.

Try it

Open https://signalfence.vercel.app and switch between the three scenarios. Nothing needs to be uploaded. Advanced users can optionally analyze a local JSON or NDJSON export inside the browser session.