Multi-dot chunk filenames trigger WAF 403 — build-time mitigation for Turbopack/Next.js

Many engineering teams deploying Next.js apps with Turbopack are tripping over an obscure but high-impact failure mode: multi-dot chunk filenames (e.g., 1.2.3.chunk.js) can match generic WAF rules at CDNs and edge providers, producing hard 403s that only appear after deployment and block production traffic. This problem is most acute for mid-market and enterprise web teams running CI-driven edge deployments where the security layer is managed by a third-party WAF and developers are expected to fix infra-caused production failures in the build pipeline. You could build a build-time mitigation plugin for Turbopack/Next.js that detects risky filename patterns, rewrites or canonicalizes chunk names into WAF-safe tokens, preserves deterministic cache keys, and emits a compact source-map-safe mapping plus optional CI diagnostics and automated rollback hooks. The product would be distributed as a lightweight NPM package and CI step, with an enterprise tier offering audit logging, policy templates for common WAF rules, and support contracts for CDN integrations. The timing is favorable: with an estimated addressable market of $8.0B (20M businesses × $400 avg annual spend) and a Market Score of 90/100 and Revenue Potential of 86/100, edge-first deployments and consolidation around Next.js/Turbopack create a concentrated point of leverage. Competition is medium, but you can stand out by shipping deep, low-latency integration in the build toolchain, proving zero-runtime overhead and reliable cache behavior, and by focusing on developer UX (one-line install, clear CI failures). Challenges include convincing security teams to accept automated filename changes and ensuring compatibility across CDNs and cache invalidation strategies, so early wins will require close pilot customers and measurable reduction in post-deploy 403 incidents.