Think of a WAF like the thinnest possible veil over your code. You wouldn't go out into public wearing the thinnest possible veil as your only piece of clothing

Think of a WAF like the thinnest possible veil over your code. You wouldn't go out into public wearing the thinnest possible veil as your only piece of clothing, would you? So make sure you bake in security through your code, and then when you are done, you can afford to make a decision about whether you need to put the thinnest possible veil over that.