RASP Runtime Protection — In Development | Bachao.AI
We are building runtime protection that sits inside the application, not in front of it.
The control plane is live in the dashboard: register an agent, manage its rules, receive runtime events. The agent itself is not released.
RASP (Runtime Application Self-Protection) embeds security controls inside the application itself, so a decision about a database query or a process call can be made with the full execution context attached — not inferred from the HTTP request at the network edge. Bachao.AI is building a server-side RASP agent. Today we can assess your readiness and plan the integration with you; the agent is not released.
What we are building RASP to do
Four attack classes we are designing detection for, and the two pieces that already exist in the dashboard.
SQL injection
Planned: inspect the database call from inside the process, so a payload is judged by the query it is about to run rather than by how the HTTP request looked.
Deserialization
Planned: watch what a deserialized object actually does — process execution, file writes, known gadget classes — and stop it before the side effect lands.
SSRF
Planned: hook the HTTP client, resolve the destination before the connection is opened, and refuse requests that land on internal or link-local addresses.
Command injection
Planned: check whether request data is reaching the arguments of a process-execution call, and reject the call when it is.
Rules from VAPT findings
In the dashboard today: open a completed Bachao.AI scan, generate candidate rules from its findings and assign them to a registered agent. It is manual and opt-in, it needs a verified domain and a purchased report, and the rules are pattern-based.
Runtime event capture
In the dashboard today: a registered agent authenticates with a hashed API key, heartbeats, and posts runtime events to your account. Passwords, tokens, cookies and API keys are redacted out of the payload before it is stored.
Language & platform coverage
The five runtimes we are building agents for first. None of them is released.
Node.js
PlannedPlanned: an agent for Express, Fastify and NestJS on maintained Node LTS releases.
Python
PlannedPlanned: an agent for Django, Flask and FastAPI, covering both WSGI and ASGI apps.
Java
PlannedPlanned: a JVM agent attached at startup, targeting Spring Boot and Jakarta EE applications.
Go
PlannedPlanned: library integration for net/http services and database/sql.
PHP
PlannedPlanned: an extension-based integration covering PDO and mysqli, for Laravel and WordPress stacks.
No agent is downloadable yet. The setup flow in the dashboard is scaffolded for these five runtimes, and the package names it shows are not published to a public registry.
WAF and RASP — where each one sits
An architectural comparison, not a scorecard. The RASP column describes what we are building.
| WAF / Traditional | RASP (what we are building) | |
|---|---|---|
| Where it runs | In front of the app, at the network edge | Inside the application process (planned) |
| What it can see | The HTTP request and response | The call the application is about to make (planned) |
| What it needs from you | A traffic path change | An agent in your runtime — not released yet |
| Maturity at Bachao.AI | Mature, widely deployed technology | In development — control plane only |
Why runtime protection is worth building — the DPDP context
Under India’s DPDP Act 2023, a single reportable data breach can draw penalties of up to ₹250 crore, on top of mandatory notification to the Data Protection Board and to every affected person. Industry benchmarks put the mean time to identify a breach at roughly 200 days (IBM Cost of a Data Breach), with weeks more to contain it. A control that refuses the malicious operation at the execution point is aimed squarely at that gap — which is why we are building one. It is not running on your account today, and we are not going to quote you a saving we have not measured.
How RASP works
Four stages of runtime protection — from instrumentation to blocking.
Planned: the agent registers hooks at security-critical call sites — database queries, process execution, file I/O and outbound HTTP.
Planned: each call is checked against the rules assigned to that agent before it runs. The detection primitive behind a rule today is pattern matching.
Built today: the agent posts every match to your account as a runtime event, with sensitive fields redacted before storage. The dashboard shows real counts, including zero.
Planned: a rule in blocking mode terminates the call and returns a safe error. Until the agent ships, nothing is enforced anywhere.
Test → Protect workflow: In the dashboard you can open a completed Bachao.AI scan, generate candidate rules from its findings and assign them to a registered agent. It is a manual, opt-in action, it is gated on a verified domain and a purchased full report, and the rules only do something once an agent is running — which is the part we have not shipped.
Why we are building RASP
The short version: a perimeter control has to guess from the request, and an in-process control does not have to guess.
The case for deciding at the execution point
A perimeter filter sees a string in a form field and has to decide whether it is an attack without knowing what the application will do with it. That is why the same payload can be a blocked request on one endpoint and a legitimate blog post about SQL on another. An agent inside the process can wait until the query, the file path or the process invocation is actually about to happen.
Getting that right is hard, and we are not going to pretend we have finished it. What exists today is the plumbing: agents can register, authenticate, heartbeat and report; rules can be written, assigned and generated from a scan. The detection logic behind a rule is currently pattern matching, and the agents that would carry it are not written.
DPDP Act and CERT-In — the context Indian businesses operate in
India's Digital Personal Data Protection Act 2023 requires organisations processing personal data to implement “reasonable security safeguards.” CERT-In's 2022 directive separately requires incident reporting within 6 hours of noticing an incident. Those obligations are real today, whatever tooling you run.
A runtime event log — timestamped, per-request, naming the function that was targeted — is a useful artefact against both. That is what we intend the agent to produce. We are not claiming it produces it today, and the current event store is an ordinary database table with no tamper-evidence, so nobody should present it to an examiner as more than it is.
Not packaged yet
RASP Protection is still being built, so there is no plan to sell you and no tier list worth printing. If it is close to what you need, talk to us — we will scope the work, tell you plainly what exists today, and quote only for that.
Where runtime protection sits in the frameworks
These are references to the frameworks Indian businesses are audited against. None of them is a statement that Bachao.AI RASP is deployed, accepted or certified — it is not yet running anywhere.
DPDP Act 2023
Requires "reasonable security safeguards." The Act names no specific technology; runtime protection is one control among several that a data fiduciary may choose to argue from.
NIST 800-53
Control enhancement SI-7(17) is titled "Runtime Application Self-Protection" — the one framework reference that names the technique directly.
RBI IT Framework
Continuous monitoring of payment systems is in scope. Our agent is not available to serve as that monitoring control today.
Technical FAQ
The questions your CTO will ask about RASP.
What is RASP and how does it work?
RASP (Runtime Application Self-Protection) is security that runs inside the application process rather than in front of it. It instruments the runtime — database calls, process execution, file I/O, outbound HTTP — so a decision can be made about the operation the code is about to perform, with the request context still attached. A WAF makes the same kind of decision from outside, using only what the HTTP request looks like.
What is actually built at Bachao.AI today?
A control plane. You can register an agent against your account and receive a setup token and a hashed API key; a registered agent can heartbeat and post runtime events, which are stored with sensitive fields redacted; you can create rules and assign them to agents; and you can generate candidate rules from a completed Bachao.AI scan. The detection primitive behind those rules is pattern matching. There is no downloadable agent, so none of this is protecting an application yet.
Which runtimes will be supported first?
Node.js, Python, Java, Go and PHP — those are the five the setup flow in the dashboard is scaffolded for. None of them is released, and the package names shown in that flow are not published to npm, PyPI, Packagist or Maven Central yet. Treat them as placeholders until we tell you otherwise.
What is the performance overhead?
We have not published a number, because we have not shipped an agent to measure. Any figure we gave you today would be invented. Measuring overhead on your workload is one of the things a pilot is for.
How does this connect to a VAPT scan?
In the dashboard you can open a completed Bachao.AI scan, map its findings to rule candidates and assign them to a registered agent. It is a manual, opt-in action — you pick the scan and confirm — and it is gated on a verified domain and a purchased full report. It is not automatic, and the rules do nothing until an agent is running.
Where would RASP data be processed?
By design the agent runs inside your infrastructure and we never receive your application data or user requests. What reaches us is event metadata — rule matched, attack class, counts — and the ingestion path already redacts passwords, tokens, cookies and API keys before anything is written. Data is held on Indian infrastructure, encrypted in transit and at rest. We will restate all of this precisely, against a shipped agent, before you run one.
Request a Quote — RASP (Runtime App Self-Protection)
Tell us a bit about what you need scoped. Shouvik will review your details and reach out within 24 hours.
Explore more products
Bachao.AI covers your entire security surface — from code to cloud to compliance.
- Certified
- Certified
- Accredited
- In process
- GDPRIn process
Want this when it ships?
We are building the agent now. Tell us your stack and we will scope a pilot — and tell you plainly what it will and will not do on the day it lands.