I recently joined a new company, and one of my first tasks is to secure a simple web API using a WAF. I’d like to explore some free and open-source options to help our office avoid licensing headaches. Do you have any recommendations?