smallwebwaf

76 Commits 5 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	3b9afd5ec4	Default request limits per minute, hour and day, sized for API use (closes #176 ) check / check (push) Successful in 5m15s Details The default request limits now suit programmatic use of an API, such as an automation fleet on another host, and still catch abusive bots: - per minute: 300, passed within seconds by a client firing as fast as it can; - per hour: 30000; - per day: 300000, passed by a crawler that keeps up 4 a second. At the default minute limit no client reaches the hour limit: 300 a minute is at most 18,000 an hour. The byte limits and ban lengths are unchanged. SPEC.md, README.md and docs/settings.md give the reasons; docs/gitea.md redoes the Actions runner sums. Judgement call: the docs/alerts.md ban example shows the minute limit. Model: opus-5-5	2026-11-04 20:16:50 +00:00
clawbot	a9dc59546b	New defaults for the request and byte limits (closes #161 ) check / check (push) Canceled after 0s Details The request limits and the hour and day byte limits now sit about twice above what 40 people busy with heavy web apps make together on one address: - requests: 6000 a minute, 100,000 an hour, 1,000,000 a day; - bytes: 20 GiB an hour, 200 GiB a day. The largest response drops from 5 GiB to 1 GiB. The minute byte limit of 4 GiB is sized to hold two of the largest responses with their requests. SPEC.md gives the new reasoning; README.md and the reference documents give the new figures. Model: opus-5-5	2026-10-27 19:28:09 +01:00
clawbot	f408f42b28	SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 ) check / check (push) Canceled after 0s Details SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8. Model: fable-5-1 (writing); opus-5-5 (review, merge)	2026-10-26 03:06:28 +01:00

Author

SHA1

Message

Date

sneak

3b9afd5ec4

Default request limits per minute, hour and day, sized for API use (closes #176 )

check / check (push) Successful in 5m15s

Details

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch abusive bots:

- per minute: 300, passed within seconds by a client firing as fast
  as it can;
- per hour: 30000;
- per day: 300000, passed by a crawler that keeps up 4 a second.

At the default minute limit no client reaches the hour limit: 300 a
minute is at most 18,000 an hour.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons; docs/gitea.md redoes the Actions
runner sums.

Judgement call: the docs/alerts.md ban example shows the minute limit.

Model: opus-5-5

2026-11-04 20:16:50 +00:00

clawbot

a9dc59546b

New defaults for the request and byte limits (closes #161 )

check / check (push) Canceled after 0s

Details

The request limits and the hour and day byte limits now sit about twice
above what 40 people busy with heavy web apps make together on one
address:

- requests: 6000 a minute, 100,000 an hour, 1,000,000 a day;
- bytes: 20 GiB an hour, 200 GiB a day.

The largest response drops from 5 GiB to 1 GiB. The minute byte limit
of 4 GiB is sized to hold two of the largest responses with their
requests. SPEC.md gives the new reasoning; README.md and the reference
documents give the new figures.

Model: opus-5-5

2026-10-27 19:28:09 +01:00

clawbot

f408f42b28

SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 )

check / check (push) Canceled after 0s

Details

SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8.

Model: fable-5-1 (writing); opus-5-5 (review, merge)

2026-10-26 03:06:28 +01:00