johnbillow

Now that's a profound insight :-)

So you yourself are only discussing HTTP. What about other types of serverless event triggers? do you know how to protect against injections in SNS? or what happens when you inject malicious input into data coming from S3? So yes, app security is app security, but there are nuances and pitfalls that are serverless specific...

Seems like these guys did a thorough job, and also involved a long list of respectable folks.

Seems like you didn't really go through the document mate. What you are saying is exactly the opposite of what I saw. Each section actually has a "difference" between traditional and serverless apps. Moreover, if you read the beginning, they point out the reasons why WAFs are irrelevant...