You are the WAF. Here comes the DDoS.
How to play
Waves of malicious requests (GET bots, SQLi, XSS, botnets) descend on your API. Move and fire WAF rules. Every 3rd wave the DDoS Mothership arrives. Grab power-ups: Rule upgrade (triple shot), CDN cache (blocks one hit) and Rate limit (slows enemies).