The wall, and where it ends.

• A volumetric flood

  Looks like

  A sudden spike of requests aimed at knocking the site offline, not at reading it.

  Stopped here

  Absorbed at the edge network, before it reaches a static site's storage or a dedicated instance.

  Costs you

  Nothing — this is included on every plan, not an upsell.

• Bots and scrapers

  Looks like

  Something pulling every page on the site as fast as it can, over and over.

  Stopped here

  Nowhere, by default. The edge network serves the requests; nothing here tells a script from a browser.

  Costs you

  Possibly your fair-use transfer allowance — see what junk traffic does to the bill below. Pattern-based filtering is real work we can build; see the honest limits below.

• Form and comment spam

  Looks like

  Automated submissions through a public form, aimed at a mailbox or a database rather than the network.

  Stopped here

  Depends on the form. This site's own quote form is the worked example below — see the honest limits for what a form without the same defences is exposed to.

  Costs you

  Nothing to the invoice, but time reading junk if the form has no defences of its own.

• Password guessing

  Looks like

  Repeated login attempts against an account, aimed at getting in rather than knocking anything down.

  Stopped here

  Nowhere at the edge — a static site has no login to try. On a dedicated instance, this is your application's own job.

  Costs you

  Nothing on the invoice. We cannot stop someone who already has valid credentials — see Access for that half of the picture.

• A traffic spike

  The rate is flat, up to the fair-use allowance set out below.

• Junk traffic counts the same as real traffic

  A bot or scraper pulling every page repeatedly uses the same transfer allowance a real visitor would. Nothing on the platform tells the two apart before they hit the allowance.

• Nobody is billed without a conversation first

  If usage sits near or above the allowance, we reach out through the quote channel before anything on the account changes — the same sequence for a viral post or a scraper, whichever it turns out to be.

See Billing for the allowances in full and the invoice they sit on.

• POST only

  Any other request method is refused outright.

• A browser on another site can't post to it

  A form on someone else's page cannot submit through this endpoint from a visitor's browser. A script that is not a browser is not stopped by this one — the checks below are what handle that.

• A hidden field a human never sees

  A field real visitors never fill in. A submission that fills it gets a cheerful "sent" response while nothing is actually sent.

• Every field capped in length

  A name, an email address, and a message all have a hard length limit, so a multi-megabyte message is not a thing.

• A real address, checked

  The email address has to look like an address or the request is refused.

• Request logs kept 90 days

  Every request to the form is logged for 90 days, not kept forever and not thrown away immediately.

1. 1

   Auto-handled

   A known, safe failure with an established fix — a crashed process, a failed health check, a stuck deploy. Restart, retry, or redeploy the last known-good version, done automatically

   No one, unless it recurs — it goes in the log, not a message to you

2. 2

   You hear from us

   Something that touched the app and needs a person to pick the right response, not just a retry. A human looks at it and decides what to do — revert, restore, or a fix in code

   You, in writing, on the same quote channel as everything else — business hours for anything that isn’t urgent

3. 3

   Outage handling

   The site or a core function is down, or badly degraded, for real users. Worked ahead of the routine queue

   You, as soon as there is something to say, with priority handling; out-of-hours response is best effort, not a staffed round-the-clock desk

• No web-application firewall or rate limiting as standard

  A standard plan checks the rules on this page and nothing more. Filtering traffic by pattern or capping request rates is a real thing we can build — just not something included by default. See Delivery for the full rule set this page's standard plan checks.

• Not a 24/7 operations centre

  The automated watching above runs continuously. The humans behind an escalation work business hours, with priority handling on a real outage — see Monitoring for the full ladder.

• We don't fix your app's own security holes for free

  A real vulnerability in your own code is a briefed change, or a piece of CustomLabs work for something too big for one pull request — not something patched silently on your behalf.

• No certification to hand you

  No SOC 2 report, no ISO 27001 certificate, no PCI scope. If your work needs one of these, you need to know that now.

• We cannot stop someone who already has your credentials

  A perimeter is a wall around the outside. A leaked password or key gets in the front door — see Access for who holds a key and how one is revoked.

• Pattern-based filtering, geo-blocking, and rate limits are real work, not a default

  Blocking traffic by pattern, by country, or by request rate is something we can build — quoted flat, the same as any other custom infrastructure request, not something switched on by asking.

• A scraped endpoint needs a cap

  A specific page or API is getting pulled too fast — the fix is a rate limit or a check written into that endpoint.

• A form needs a stricter check

  Spam is getting through — the fix is a stronger check written into that form, the same shape as the one on this site's own quote form above.

• A dependency has a published vulnerability

  One of your application's own dependencies is flagged — see Patching for how a routine scan finds this and triages it as application-level.

• A key or credential has leaked

  A secret is out — the fix is rotating it and changing how it's handled, both application-level changes.

Every one of those four ships the same way — Agentic iteration — CodeHerder ($25/mo):

1. 1

   A routine scan flags a dependency

   The same kind of check that watches the infrastructure layers above, run against your application’s own dependency list.

2. 2

   It's triaged as application-level, not infrastructure

   A library your own code imports isn't ours to patch silently — it can change how the app behaves.

3. 3

   Briefed as a change

   Written up the same way any other change request is — this is what the Agentic iteration — CodeHerder add-on covers.

4. 4

   An agent opens the pull request

   The upgrade lands as a real pull request against the repository, with the test suite run against it.

5. 5

   A human reviews and merges

   Someone reads the diff before it goes anywhere near production — nothing here is auto-applied blind.

6. 6

   It ships through the same pipeline

   The same pipeline that deploys everything else on your stack ships this too — no separate process to babysit.

7. 7

   You're told it's done

   A note confirming what changed and that it merged, in the same shape as every other note on this site.

A hole too big for one pull request is scoped as its own piece of work by CustomLabs — see The Loop for the full build-iterate-run picture.

• One channel in

  The quote form is the only channel in for a security report, for a customer or an outside researcher alike.

• What happens with a report

  A human reads it, triages it the same way any other incident is triaged, and tells you what happens next.

• What we will not do

  No bounty is paid, and a good-faith report is never met with a legal threat.

• A machine-readable pointer

  This policy is also published at /.well-known/security.txt, the standard address a researcher or a scanner checks first.

Full binding text: Acceptable Use.

1. 01If a bot floods my site, does it cost me money?

   A volumetric flood, no — the edge network absorbs it at no charge. A bot or scraper that pulls every page repeatedly can add up against your fair-use transfer allowance, the same as any other traffic. See what junk traffic does to the bill above.

2. 02Can you block visitors from a specific country?

   Not as a standard-plan default. Geo-blocking is real work we can build, quoted flat, the same as a pattern-based filtering rule.

3. 03Do you have a web-application firewall?

   A standard plan checks the rules on this page and nothing more. Filtering traffic by pattern or capping request rates is a real thing we can build — just not something included by default. See Delivery for what a standard plan checks by default.

4. 04Someone is scraping my prices. What now?

   Brief it as a change to the affected page or API — a rate limit or a stricter check written into that one endpoint. It ships through the same pipeline as any other change: an agent opens the pull request, a human merges it.

5. 05Do you have SOC 2, ISO 27001, or PCI certification?

   No. This page describes real, current operating practice, in writing — it is not a substitute for a formal certification if your situation specifically requires one.

6. 06I found a security bug on your site. Where do I send it?

   Through the quote form — it's the only channel in. See the disclosure section above for what happens next, and /.well-known/security.txt for the machine-readable pointer.