smallwebwaf

76 Commits 5 Branches 2 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
sneak	8bdffbd418	Default request limits per minute, hour and day, sized for API use (closes #176 ) check / check (push) Successful in 7m3s Details The default request limits now suit programmatic use of an API, such as an automation fleet on another host, and still catch abusive bots: - per minute: 500, room for a fleet's busiest minute and a few first visits with an empty cache, and passed within seconds by a client firing as fast as it can; - per hour: 20000, passed by a client that keeps up 6 a second; - per day: 300000, passed by a scraper that keeps up 4 a second. The byte limits and ban lengths are unchanged. SPEC.md, README.md and docs/settings.md give the reasons; docs/gitea.md redoes the Actions runner sums. Judgement call: the docs/alerts.md ban example shows the minute limit. Model: opus-5-5	2026-11-04 21:42:33 +00:00
clawbot	a9dc59546b	New defaults for the request and byte limits (closes #161 ) check / check (push) Canceled after 0s Details The request limits and the hour and day byte limits now sit about twice above what 40 people busy with heavy web apps make together on one address: - requests: 6000 a minute, 100,000 an hour, 1,000,000 a day; - bytes: 20 GiB an hour, 200 GiB a day. The largest response drops from 5 GiB to 1 GiB. The minute byte limit of 4 GiB is sized to hold two of the largest responses with their requests. SPEC.md gives the new reasoning; README.md and the reference documents give the new figures. Model: opus-5-5	2026-10-27 19:28:09 +01:00
clawbot	f408f42b28	SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 ) check / check (push) Canceled after 0s Details SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8. Model: fable-5-1 (writing); opus-5-5 (review, merge)	2026-10-26 03:06:28 +01:00

Author

SHA1

Message

Date

sneak

8bdffbd418

Default request limits per minute, hour and day, sized for API use (closes #176 )

check / check (push) Successful in 7m3s

Details

The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch abusive bots:

- per minute: 500, room for a fleet's busiest minute and a few first
  visits with an empty cache, and passed within seconds by a client
  firing as fast as it can;
- per hour: 20000, passed by a client that keeps up 6 a second;
- per day: 300000, passed by a scraper that keeps up 4 a second.

The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons; docs/gitea.md redoes the Actions
runner sums.

Judgement call: the docs/alerts.md ban example shows the minute limit.

Model: opus-5-5

2026-11-04 21:42:33 +00:00

clawbot

a9dc59546b

New defaults for the request and byte limits (closes #161 )

check / check (push) Canceled after 0s

Details

The request limits and the hour and day byte limits now sit about twice
above what 40 people busy with heavy web apps make together on one
address:

- requests: 6000 a minute, 100,000 an hour, 1,000,000 a day;
- bytes: 20 GiB an hour, 200 GiB a day.

The largest response drops from 5 GiB to 1 GiB. The minute byte limit
of 4 GiB is sized to hold two of the largest responses with their
requests. SPEC.md gives the new reasoning; README.md and the reference
documents give the new figures.

Model: opus-5-5

2026-10-27 19:28:09 +01:00

clawbot

f408f42b28

SPEC, README and docs rewritten from scratch (closes #154 , closes #155 , closes #156 )

check / check (push) Canceled after 0s

Details

SPEC.md is the only place that says how smallwebwaf behaves and why; docs/ holds lists linking to it; the README is short and links to both. Passed independent review in round 8.

Model: fable-5-1 (writing); opus-5-5 (review, merge)

2026-10-26 03:06:28 +01:00