Arcjet

Arcjet provides a developer-focused security platform designed to be integrated directly into an application's codebase. Founded in 2023 by David Mytton and headquartered in San Francisco, the company aims to shift security from a separate, network-level function to an integral part of the development workflow. Mytton, a serial entrepreneur who previously founded Server Density (acquired) and Console.dev, started Arcjet to address a gap in security tooling for developers using modern frameworks on platforms like Vercel and Netlify. He identified that traditional tools like network firewalls are often incompatible with modern deployment models and lack the application-level context needed for effective security.

The company's core offering is a Software Development Kit (SDK) that enables developers to implement features such as bot detection, rate limiting, email validation, and protection against common attacks like SQL injection with a few lines of code. Arcjet supports a variety of modern frameworks and runtimes, including Next.js, Node.js, Bun, and SvelteKit. The system operates on a hybrid model; the SDK includes a local WebAssembly module for fast, in-environment analysis, while also calling a global, low-latency cloud API for signals that require broader context, such as IP reputation. This allows developers to test security rules locally and ensure they function identically in production, avoiding unexpected issues upon deployment.

Arcjet's business model is B2B, providing its tools as a service. While the SDKs are open-source under an Apache-2.0 license, the cloud API, which provides threat intelligence and real-time analysis, is a proprietary, paid service. The company has secured significant funding, including a $3.6 million seed round led by Andreessen Horowitz and a subsequent Series A round, bringing total funding to $12.1 million. This capital is being used to expand its security components and support additional programming languages, with Python planned after JavaScript.

Keywords: developer security, SDK, application security, bot detection, rate limiting, Next.js security, Node.js security, Vercel security, Netlify security, serverless security, edge computing security, David Mytton, Andreessen Horowitz, Seedcamp, application-level security, security as code, web application firewall, API security, fraudulent signup prevention, content scraping protection, cybersecurity, DevSecOps, JavaScript security, cloud-native security