smallwebwaf

76 Commits 4 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	35054fe94b	Default request limits per hour and per day, sized for API use (closes #176 ) check / check (push) Failing after 1m45s Details The default request limits now suit programmatic use of an API, such as an automation fleet on another host, and still catch crawlers: - per minute: off; - per hour: 30000, passed by a crawler that keeps up 10 a second; - per day: 300000, passed by one that keeps up 4 a second. The byte limits and ban lengths are unchanged. SPEC.md, README.md and docs/settings.md give the reasons and what counting cannot catch; docs/gitea.md redoes the Actions runner sums. Judgement call: the ban alert example in docs/alerts.md now shows the hour limit, since the minute limit is off by default. Model: opus-5-5	2026-11-04 19:50:41 +00:00
clawbot	a9dc59546b	New defaults for the request and byte limits (closes #161 ) check / check (push) Canceled after 0s Details The request limits and the hour and day byte limits now sit about twice above what 40 people busy with heavy web apps make together on one address: - requests: 6000 a minute, 100,000 an hour, 1,000,000 a day; - bytes: 20 GiB an hour, 200 GiB a day. The largest response drops from 5 GiB to 1 GiB. The minute byte limit of 4 GiB is sized to hold two of the largest responses with their requests. SPEC.md gives the new reasoning; README.md and the reference documents give the new figures. Model: opus-5-5	2026-10-27 19:28:09 +01:00
clawbot	f408f42b28	SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 ) check / check (push) Canceled after 0s Details SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8. Model: fable-5-1 (writing); opus-5-5 (review, merge)	2026-10-26 03:06:28 +01:00

Author

SHA1

Message

Date

sneak

35054fe94b

Default request limits per hour and per day, sized for API use (closes #176 )

check / check (push) Failing after 1m45s

Details

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch crawlers:

- per minute: off;
- per hour: 30000, passed by a crawler that keeps up 10 a second;
- per day: 300000, passed by one that keeps up 4 a second.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons and what counting cannot catch;
docs/gitea.md redoes the Actions runner sums.

Judgement call: the ban alert example in docs/alerts.md now shows the
hour limit, since the minute limit is off by default.

Model: opus-5-5

2026-11-04 19:50:41 +00:00

clawbot

a9dc59546b

New defaults for the request and byte limits (closes #161 )

check / check (push) Canceled after 0s

Details

The request limits and the hour and day byte limits now sit about twice
above what 40 people busy with heavy web apps make together on one
address:

- requests: 6000 a minute, 100,000 an hour, 1,000,000 a day;
- bytes: 20 GiB an hour, 200 GiB a day.

The largest response drops from 5 GiB to 1 GiB. The minute byte limit
of 4 GiB is sized to hold two of the largest responses with their
requests. SPEC.md gives the new reasoning; README.md and the reference
documents give the new figures.

Model: opus-5-5

2026-10-27 19:28:09 +01:00

clawbot

f408f42b28

SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 )

check / check (push) Canceled after 0s

Details

SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8.

Model: fable-5-1 (writing); opus-5-5 (review, merge)

2026-10-26 03:06:28 +01:00