Security and compliance buyers deserve reproducible numbers, public test corpora, and clear engineering boundaries—not marketing claims of "100% protection". Below are our dated benchmark results, how they are measured, and what each engine does and does not catch.
0.024 ms–0.503 ms) measure in-Worker V8 compute time across the Hono Gateway pipeline (request-ID, streaming size cap, constant-time auth, Zod schema validation, domain logic, and JSON serialization). In production over the public internet, callers should expect 15–65 ms of end-to-end HTTPS network RTT to the nearest Cloudflare edge PoP (or 45–120 ms if routing through a RapidAPI or Zyla proxy hop)..github/workflows/weekly-benchmarks.yml):
scripts/benchmark-prompt-guard.ts — 104 labeled prompts modeled on OWASP LLM01 / BIPIA indirect-injection taxonomies across 7 attack classes and 10 languages.scripts/benchmark-secret-scanner.ts — 60 labeled cases benchmarked for rule parity against gitleaks and trufflehog vendor token formats (28 secret categories) + false-positive resistance on UUIDv4s, Git SHAs, and lockfile SHA-512 SRI hashes.scripts/benchmark-hallucination-diff.ts — 25 RAG source-answer pairs testing numeric, date, currency, entity, and semantic negation sensitivity.scripts/benchmark-all-apis.ts & scripts/perf-probe-all.ts — 49-endpoint (42-API) full-gateway latency benchmark + 256 KB pathological ReDoS/CPU-budget stress tests./v1/prompt-guard v2)
Evaluated via scripts/benchmark-prompt-guard.ts against a 104-prompt labeled corpus (64 adversarial attacks across 7 categories + 10 languages, and 40 benign developer/support/code prompts) at default sensitivity: "medium" in deterministic mode (use_ai_judge: false):
| Metric | Measured Value (14 Nov 2026) | Notes |
|---|---|---|
| Detection Recall (TPR) | 93.8% (60 / 64 attacks flagged) | Covers direct overrides, role hijacks, system prompt extraction, Base64/Hex/ROT13/Leetspeak, Unicode tags, and multilingual attacks |
| False Positive Rate (FPR) | 0.0% (0 / 40 benign prompts flagged) | Includes benign SQL/Python discussions, security training questions, and multilingual business emails |
| Precision / F1 Score | 100.0% Precision / 96.8% F1 | Zero false alarms on the benign benchmark set |
| In-Worker V8 Compute Time | P50: 0.024 ms · P99: 1.040 ms | In-process V8 isolate compute (full Hono Gateway compute P50 is 0.384 ms; client HTTPS RTT is typically 15–65 ms; optional use_ai_judge: true adds ~150–450 ms) |
/v1/secret-scanner)
Evaluated via scripts/benchmark-secret-scanner.ts against a 60-case labeled corpus (40 structured & high-entropy secrets covering all 28 supported secret categories compared against gitleaks/trufflehog rule sets, plus 20 benign logs, stack traces, UUIDs, Git SHAs, and lockfile SRI hashes):
| Metric | Measured Value (14 Nov 2026) | Notes |
|---|---|---|
| Detection Recall (TPR) | 100.0% (40 / 40 secrets detected, 0 misses) | Near-zero misses across all 28 categories (AWS, GitHub, GitLab, Stripe, Slack, OpenAI, Anthropic, Google AI, HuggingFace, SendGrid, Twilio, Mailgun, NPM, PyPI, Docker, Shopify, Databricks, DigitalOcean, Linear, Supabase, Postman, Discord, Telegram, PEM keys, JWT, Basic/Bearer Auth, DB URIs, high-entropy assignments) |
| False Positive Rate (FPR) | 0.0% (0 / 20 benign cases flagged) | Zero false alarms on UUIDv4s, 40/64-char Git SHAs, SHA-512 SRI hashes, CSS hashes, stack traces, and example placeholders |
| Precision / F1 Score | 100.0% Precision / 100.0% F1 | Deterministic prefix + structural rules combined with context-gated Shannon entropy |
| In-Worker V8 Compute Time | P50: 0.051 ms · P99: 2.864 ms | In-process V8 isolate compute (full Hono Gateway compute P50 is 0.209 ms; client HTTPS RTT is typically 15–65 ms) |
AKIA, ghp_, sk_live_, xoxb-, etc.) are deterministic, generic unprefixed secret detection (HIGH_ENTROPY_SECRET) is heuristic and relies on variable-name context + Shannon entropy calculation./v1/hallucination-diff)
Evaluated via scripts/benchmark-hallucination-diff.ts against 25 labeled RAG source-answer pairs (10 grounded answers, 13 factual number/date/entity hallucinations, and 2 pure semantic negation inversions) in deterministic mode (use_ai_judge: false):
| Metric | Measured Value (14 Nov 2026) | Notes |
|---|---|---|
| Human-Judgment Agreement Rate | 92.0% (23 / 25 pairs) | Agrees with human labels on 23 of 25 benchmark cases |
| Factual Number & Entity Recall | 100.0% (13 / 13 factual fabrications caught) | Catches all unsupported numbers, percentages, currencies, dates, and proper-noun entities |
| Grounded Answer Precision | 100.0% (10 / 10 grounded answers passed) | Handles comma-normalized numbers (e.g. 10,000 vs 10000) without false alarms |
| In-Worker V8 Compute Time | P50: 0.051 ms · P99: 1.297 ms | In-process V8 isolate compute (full Hono Gateway compute P50 is 0.178 ms; optional use_ai_judge: true adds ~150–400 ms) |
use_ai_judge: true: Use deterministic mode as a fast (< 2 ms), zero-cost first filter on every RAG response, and enable use_ai_judge: true (Cloudflare Workers AI @cf/meta/llama-3.1-8b-instruct) when semantic contradiction detection is required.
Unlike statistical classifiers, /v1/tool-call-validator and /v1/mcp-manifest-linter are validated for deterministic correctness against provider specifications using dedicated JSON fixture suites in CI:
/v1/tool-call-validator): Tested against fixture suites for OpenAI Chat Completions API (2024-10-01+ tool_calls & wrapped tools), OpenAI Responses API (2025-03-01+ function_call), Anthropic Messages API (2023-06-01 tool_use & input_schema), Google Gemini API (v1beta / v1 functionCall), and Model Context Protocol (2024-11-05 & 2025-03-26 JSON-RPC 2.0 tools/call) with JSON Schema Draft-07 / 2020-12 validation./v1/mcp-manifest-linter): Tested against fixture suites for MCP 2024-11-05 and MCP 2025-03-26 (including annotations.readOnlyHint, destructiveHint, idempotentHint, openWorldHint, and mcpServers command configs). Static analysis does not execute or sandbox the MCP server binary at runtime.For financial, tax, and cryptographic endpoints where a false validation carries legal or security impact, each engine is verified against statutory checksum algorithms and RFC test vectors in CI:
/v1/invoice-validator): Verified across 27 EU member-state statutory VAT rate tables, line-item rounding tolerances (quantity × unit_price − discount = net), header tax breakdown reconciliation, EN 16931 mandatory business terms (BT-1 through BT-115), and cross-checked seller/buyer IBAN & EU VAT checksums. Limitation: Validates mathematical, tax-rate, and semantic EN 16931 rules on JSON payloads; it does not replace an accredited Peppol Access Point for AS4 XML transmission or live national tax-authority clearance (such as Hungarian NAV Online Számla or Italian SDI)./v1/eu-vat-iban, /v1/hu-business-validator, /v1/eu-id-validator): Verified against official statutory check-digit specifications: ISO 13616 IBAN MOD-97-10 across 85+ countries, ISO 17442 LEI + LOU prefix directory, EU27/UK EORI, French SIREN/SIRET (Luhn + INSEE La Poste rule), German Steuer-ID (ISO 7064 Mod 11,10), Italian Codice Fiscale (Agenzia delle Entrate odd/even mod-26), Spanish NIF/NIE/CIF, Polish NIP/PESEL, Dutch BSN/RSIN (Elfproef), Hungarian Adószám/Adóazonosító jel/Cégjegyzékszám/Giro 8-8-8, UK CRN, and US EIN IRS campus prefixes. Limitation: Offline mathematical checksum validation confirms structural and check-digit validity in <0.2 ms; it does not query live national company registries unless verify_vies: true is enabled on /v1/eu-vat-iban/vat./v1/jwt-jwk-inspector): Verified against RFC 7515 / RFC 7517 / RFC 7518 / RFC 8725 security test vectors: detects alg: "none", jku/x5u/kid header injection, symmetric/asymmetric algorithm confusion, weak HMAC secrets via WebCrypto crypto.subtle, and private key parameters (d, p, q, k) leaked in public JWKS.
Evaluated via scripts/benchmark-all-apis.ts across all 42 APIs (49 POST endpoints, 100 measured iterations each after 10 warmup iterations) through the full Hono Gateway pipeline (request-ID, streaming size cap, constant-time auth, Zod OpenAPI validation, domain logic, and JSON envelope serialization):
| Portfolio Metric | Measured Value (14 Nov 2026) | Notes |
|---|---|---|
| HTTP 200 Success Rate | 100.0% (49 / 49 endpoints) | All 42 APIs and multi-route endpoints verified end-to-end |
| Portfolio Median P50 Compute Time | 0.205 ms (Min: 0.130 ms, Max: 2.996 ms) |
In-Worker V8 compute time (add 15–65 ms for typical client HTTPS network RTT to nearest Cloudflare PoP) |
| Portfolio Median P99 Compute Time | 0.510 ms (Min: 0.214 ms, Max: 3.689 ms) |
100% of endpoints achieve sub-4 ms P99 in-Worker compute time (256 KB pathological stress test max is 12 ms, well below the 100 ms Worker CPU cap) |