How does it work?

[cedws]

I've been wanting something like this for a long time, so thanks for releasing it. From a quick glance I can't really tell how it works though. It would be nice to have a section in the README.

Does bullfrog operate at a higher privilege level than executed Actions and thereby completely block malicious traffic, or does it only mitigate unsophisticated attacks that don't know how to bypass it?