How does SafeLine update protections for new CVEs?

Hi Safeline team,

I'm currently evaluating SafeLine Pro through the 7-day trial and have a few questions about how the protection mechanism works.

I noticed that SafeLine provides update options for things like the Malicious IP Group, Search Engine Spider, and JA4 Fingerprint Database.

However, I'm not sure how SafeLine handles newly disclosed web vulnerabilities or CVEs.

For example, when a new RCE, SQL Injection, or other web vulnerability is published:

1. How does SafeLine update its protection against newly disclosed vulnerabilities? Is it updated automatically?
2. Does it require upgrading SafeLine to a newer version? Or is there another update process that administrators need to perform?

I also have a few additional questions:

3. Is the update mechanism the same for Community Edition and Pro Edition, or does Pro receive additional or faster protection updates?
4. Are vulnerability protection updates tied to the license?
5. Is it possible to view the detailed detection logic for specific attack categories (for example, SQL Injection or XSS), or are the detection rules not publicly exposed?

Thanks!

1. When new vulnerabilities emerge, we push Enhanced Rules to detect

2. In terms of threat detection capability, the update mechanism and protection engine are the same across Community (or Personal) Edition and Pro.
   Pro's advantage is access to more advanced configuration features and flexibility.

3. Vulnerability protection updates are not tied to the license.

4. Detailed detection logic is not publicly available, it's part of our intellectual property.
   

Thanks!

i have 1 more question

Could you explain what "push Enhanced Rules" means in practice?

Are they automatically downloaded, included in new releases, or updated manually?

If Enhanced Rules are included in new releases, do I need to upgrade the Docker deployment (for example, pull a new image and recreate the containers) to receive them, or can they be updated independently?

If a Docker upgrade is required, how are user configurations preserved, such as IP allowlists/blocklists, custom rules and other settings? Is there an official upgrade procedure or documentation that explains the recommended upgrade process?

thanks,
i have a question
Does SafeLine support role-based access control (RBAC) for the management console?
For example, if a single SafeLine instance protects multiple domains, can different administrator accounts be restricted so that each admin can only view and manage their assigned domains, instead of having access to all applications?

Does SafeLine Pro come with direct technical support, such as private live chat or a dedicated support channel (beside discord cho for every user)? If not, which edition or plan includes that level of support?

does Safeline have api security?

We're currently evaluating SafeLine Pro for enterprise deployment in our company, and we'd like to better understand some deployment and scalability aspects.

1. If we deploy two SafeLine WAF instances (for example, one in Northern Vietnam and one in Southern Vietnam) to protect the same application, what's the recommended architecture? Can they share the same configuration/database, or does each node maintain its own data? Is there any built-in synchronization or centralized management?
2. If multiple WAF nodes are deployed in different regions, is there any built-in traffic steering or nearest-node preference, or should this be handled by an external CDN, DNS, or load balancer?
3. Regarding performance, do you have any sizing guide or benchmark (RPS, concurrent connections, throughput, etc.) that maps recommended hardware specifications to different traffic scales? We'd like to understand the recommended production hardware for large-scale deployments rather than just the minimum requirements.
4. Finally, can the user-facing pages (block page, challenge page, waiting room, authentication page, etc.) be customized? Also, is the management console customizable or white-label friendly?

i want to know more about safeline before i check the enterprise edition,
I have a few questions regarding SafeLine's logging architecture.

1. Where are security logs stored? what storage/database is used?
2. How long are logs retained by default? Is the retention period configurable?
3. Is there any official documentation describing the logging architecture and storage mechanism?
4. If multiple SafeLine WAF instances are deployed (e.g., Master/Slave or Active-Active), how are logs handled? Are logs synchronized between nodes, or does each WAF keep its own local logs?
5. If each node stores logs independently, what is the recommended approach for centralized log collection and searching across multiple WAF nodes? (beside the enterprise/custom edition)

If we deploy two SafeLine WAF nodes, is it possible for us to build our own management portal to manage both nodes? Does SafeLine provide APIs that allow us to manage configurations, rules, applications, logs, etc. from an external portal? If so, is there any API documentation or integration guide available?

thanks carrie