G-FUSE watches Cloudflare, Vercel and Supabase at once and trips before a bot storm, a runaway loop or a leaked key becomes a five-figure invoice. Warn, throttle, then pause — one project, not your whole account.
Estimates from public list prices (September 2026), cheapest region: Cloudflare Workers $0.30/M requests + $0.02/M CPU-ms (≈5 ms each), no egress charge; Vercel $0.60/M invocations + $0.06/GB Fast Origin Transfer, plus $0.15/GB Fast Data Transfer for teams without Flat Rate CDN (GA Sept 8, 2026, on by default for new Pro teams); Supabase $0.09/GB egress; Netlify 20 credits/GB ≈ $0.13/GB (auto-recharge is off by default, so Netlify's real default is a hard stop that pauses every project). Included quotas ignored — the point is the slope, not the cents. G-FUSE detection window assumed at 60 seconds. On Cloudflare the requests are the cheap part: what the Worker touches (KV writes $5/M, R2 Class A $4.50/M, D1 writes $1/M) is where the slope gets steep.
Platform-native caps check every few minutes and pause everything. G-FUSE polls Cloudflare's analytics every 30–60 seconds, listens to Vercel's spend and usage-anomaly webhooks, reads Supabase's API counters, and compares all of it to your project's own baseline before escalating — so a launch-day spike gets a warning and a bot storm gets a wall.
Email, SMS, WhatsApp or Slack with the project, the metric and the slope. Nothing changes in production. This is the default for every new rule.
Cloudflare: a rate-limit rule on the affected path, or Under Attack for that one host — not the whole zone. Vercel: promote your last static deployment. Supabase: tighten Auth rate limits and pause signups. Real users mostly keep working.
Detach the Worker route (Cloudflare) or pause that one project (Vercel) — never the whole team — and post a one-click undo. Every action is logged with the numbers that triggered it, and you get a post-mortem you can paste into a support ticket.
Your project doesn't live on one platform, and neither does the attack. Native caps only see their own slice.
Card only. Cancel in one click. 14-day no-questions refund.
Early access opens in cohorts of 50. Waitlist members get Breaker free for the first three months and a say in which platform ships next.
Because you can read exactly what we do with it. The agent that calls platform APIs is open source and pinned by version. Tokens are scoped to the minimum each action needs (a Cloudflare token can edit one zone's rate-limit rules and nothing else), encrypted with a per-account key, never logged, and revocable from your dashboard or from the platform side at any time.
Rules are relative to your own baseline and escalate through Warn and Throttle before anything pauses. New rules start in Warn-only for seven days. A real launch looks like a ramp; a bot storm looks like a wall. And every pause has a one-click undo that also raises your limit for 24 hours.
Then you're exactly where you are today — no worse. We run on fixed-price servers in two regions, never on usage-billed infrastructure, and we page ourselves before we page you. A missed check never triggers an action; only observed usage does.
It does, and you should turn it on. It checks every few minutes and pauses every project on your team at once, with manual resume per project. Vercel also has no real-time usage API — its billing endpoint is day-granular — so on Vercel we combine its spend webhook, its usage-anomaly alerts and a daily billing reconciliation, and act per project: promote a static deployment first, pause only if the slope keeps climbing. Cloudflare and Supabase live in the same rule. Use both.
Yes — GA on September 8, 2026, on by default for new Pro teams, and it's good: CDN requests and Fast Data Transfer become a capacity tier with spike protection, so the classic "$23,000 of bandwidth" story is largely off the table there. It does not cover Fluid compute, Fast Origin Transfer, ISR, image optimization or Blob operations — the meters a bot storm on a function route actually spins — and those still run through Spend Management, which pauses the whole team. Existing teams have to opt in. Pick the "Flat Rate CDN on" option in the calculator to see what's left.
Cloudflare's CTO said on Hacker News in June 2026 that one is "in the works" with no date. When it lands we expect the same shape as everyone else's: account-wide, checked every few minutes, blunt. G-FUSE is per project, baseline-aware, escalates before it pauses, and covers the other platforms in the same rule. If a native cap ever makes that redundant, we'll say so on this page rather than pretend otherwise.
cf-monitor is a good open-source choice if you only run Cloudflare and want budgets inside your code: you install an npm package, wrap each Worker in monitor(), deploy a monitoring Worker on the account, and a tripped budget makes that feature return a 503 until it resets. G-FUSE needs no code change and no redeploy — one scoped token, watching from outside — covers Vercel and Supabase in the same rule, and escalates per route or host (warn, rate-limit, detach) with a one-click undo. They aren't exclusive: in-code limits plus an outside breaker is belt and braces.
No. We read usage counters and billing meters from platform APIs — request counts, bytes, CPU time, dollars. Never request bodies, never your database, never your users.