Reputation decisions, enforced at the edge.

Repsheet decides whether an actor (an IP address, a network, a session, an API key) is blocked, allowed, or marked. nginx applies that decision on every request, from memory, with no network round trip.

Quick start Source

Block

nginx rejects the request (403 by default) before it reaches your application.

Allow

Trusted actors skip every block and mark, whoever recorded them.

Mark

The request goes through, carrying the signal. Pass it to your application, log it, or rate limit it with limit_req.

Where decisions come from

Active detectors: Run inside nginx, in real time. The bot verifier catches clients that claim to be search engine crawlers but aren't.
Passive detectors: Run out of band on logs and other signals. The status-codes detector blocks addresses that collect too many error responses. Anything that can send a Redis command can be one: your SIEM, a WAF, a script.
People: Through the admin UI or valkey-cli.

Fast enough to forget about

Repsheet adds well under a microsecond of CPU per request, even with a million decisions loaded, and nothing measurable to latency from p50 to p99. If Valkey goes away, nginx keeps serving from the last decisions it had. See the benchmarks.

This site runs it

getrepsheet.com is served by nginx with Repsheet, the bot verifier, and the status-codes detector, all running in front of this page. The whole setup is open source.