ModSecurity v3 (libmodsecurity) is a C++17 Web Application Firewall (WAF) rule engine that parses SecLang configuration and rules, then evaluates them against HTTP transaction data. It is a library rather than a standalone server: connectors such as nginx or IIS feed requests through Transaction phase methods (processConnection, processURI, processRequestHeaders, processRequestBody, processResponseHeaders, processResponseBody, processLogging). The engine resolves ModSecurity variables (ARGS, REQUEST_HEADERS, FILES, TX, etc.), applies transformation pipelines (base64Decode, urlDecode, normalisePath, removeComments, htmlEntityDecode), evaluates operators (rx, pm, ipMatch, detectSQLi/detectXSS via libinjection, verifyCC, geoLookup), and executes actions (deny, allow, redirect, setvar, ctl:*). It supports multipart/JSON/XML/urlencoded request body parsing, audit logging through serial/parallel/HTTPS writers, and persistent collections on LMDB or in-memory backends. The code is organized around plugin-style base classes and factory instantiation for actions, operators, transformations, and variables, with a Bison/Flex generated parser for the SecLang grammar. Although the repository contains a rich JSON-based regression-test corpus, its character is overwhelmingly an application/library, not a data-research project. Architecture is modular but carries legacy baggage: autotools build system, extensive #ifdef feature gates (CURL, LMDB, Lua, libxml2, GeoIP/MaxMind, ssdeep, PCRE/PCRE2), manual memory management, and some stubbed operators. Duplicated CI workflows and long-standing TODOs indicate medium technical drift, but the project remains actively maintained and is a solid, widely deployed security library with several genuinely reusable low-level components.