2 ms·

There least I heard their WAF is just Apache's mod_security rules transpiled to Lua. So yes it's pretty much just regexes