DevProxy bundles debugging, chaos testing and security auditing into one Go binary

One proxy, three jobs

A developer has released DevProxy, an open-source local HTTP/HTTPS proxy written in Go that combines traffic debugging, resilience testing and passive security auditing in a single static binary. According to the announcement on dev.to, the project is hosted on GitHub as Aditya-9-6/DevProxy and ships with an embedded dark-mode web console, leaving little to install beyond the binary itself.

DevProxy sits between a local application and the wider network, inspecting and manipulating the requests that pass through it — the same position long occupied by tools such as Charles Proxy, Fiddler and mitmproxy. The pitch here is consolidation. Instead of running one program to watch traffic, another to simulate failures and a third to hunt for leaked credentials, a developer routes everything through one process.

The debugging half of the feature list includes Map Local and Map Remote, which redirect requests to local files or alternative endpoints. The resilience half covers chaos fault injection, network throttling presets that emulate Slow 3G, LTE and offline conditions, and an OpenAPI 3.0 contract validator that checks live traffic against a specification.

Performance claims built on Go idioms

The most technically specific claims concern throughput. The dev.to post describes a "zero-latency decoupled ring buffer" said to forward requests in microseconds, along with zero-allocation streaming implemented through sync.Pool buffer recycling — a standard Go pattern that reuses memory instead of allocating fresh buffers on every request and adding garbage-collector pressure. As with any solo announcement, these figures come from the author rather than an independent benchmark, and no comparative measurements have been published yet.

Security checks that watch traffic instead of scanning targets

The auditing features are passive: they examine data already flowing through the proxy rather than probing an application directly. The post lists secret scanning built on the Aho-Corasick string-matching algorithm, a JWT linter that flags tokens signed with the alg: none algorithm, detection of GraphQL abuse patterns, and PII detection that applies the Luhn mod-10 checksum, the standard validity test behind payment card numbers.

Why it matters

Developers normally encounter these capabilities in separate tools at separate times: a proxy during debugging, a chaos platform before a release, a secret scanner somewhere in CI. Folding them into one process changes when feedback arrives. A leaked API key or a badly signed JWT can surface while the code is still running locally, and resilience checks become part of everyday development rather than a late-stage gate.

The implementation language shapes the distribution story too. Go produces static binaries, so a proxy with an embedded UI can be dropped into a development environment without runtime dependencies or an installer, removing much of the setup friction that keeps heavier toolchains from spreading across a team.

There are caveats worth stating plainly. This is an early project from an individual developer, announced in a Show HN-style post, and headline claims such as zero latency and zero allocations remain design goals until someone measures them independently. For now it is best treated as a promising complement to existing tooling rather than a replacement. The direction, though, is sound: a local proxy is already a choke point for traffic, and hanging observability, resilience and security checks on that choke point is a cheap way to make all three happen at once.