G-FUSE watches Cloudflare, Vercel and Supabase at once and trips before a bot storm, a runaway loop or a leaked key becomes a five-figure invoice. Warn, throttle, then pause — one project, not your whole account.
Estimates from public list prices (September 2026): Cloudflare Workers $0.30/M requests + CPU; Vercel $0.60/M invocations + $0.15/GB transfer; Supabase $0.09/GB egress; Netlify $0.55/GB. Included quotas ignored — the point is the slope, not the cents. G-FUSE detection window assumed at 60 seconds.
Platform-native caps check every few minutes and pause everything. G-FUSE polls Cloudflare's analytics every 30–60 seconds, listens to Vercel's spend and usage-anomaly webhooks, reads Supabase's API counters, and compares all of it to your project's own baseline before escalating — so a launch-day spike gets a warning and a bot storm gets a wall.
Email, SMS, WhatsApp or Slack with the project, the metric and the slope. Nothing changes in production. This is the default for every new rule.
Cloudflare: a rate-limit rule on the affected path, or Under Attack for that one host — not the whole zone. Vercel: promote your last static deployment. Supabase: tighten Auth rate limits and pause signups. Real users mostly keep working.
Detach the Worker route (Cloudflare) or pause that one project (Vercel) — never the whole team — and post a one-click undo. Every action is logged with the numbers that triggered it, and you get a post-mortem you can paste into a support ticket.
Your project doesn't live on one platform, and neither does the attack. Native caps only see their own slice.
Card only. Cancel in one click. 14-day no-questions refund.
Early access opens in cohorts of 50. Waitlist members get Breaker free for the first three months and a say in which platform ships next.
Because you can read exactly what we do with it. The agent that calls platform APIs is open source and pinned by version. Tokens are scoped to the minimum each action needs (a Cloudflare token can edit one zone's rate-limit rules and nothing else), encrypted with a per-account key, never logged, and revocable from your dashboard or from the platform side at any time.
Rules are relative to your own baseline and escalate through Warn and Throttle before anything pauses. New rules start in Warn-only for seven days. A real launch looks like a ramp; a bot storm looks like a wall. And every pause has a one-click undo that also raises your limit for 24 hours.
Then you're exactly where you are today — no worse. We run on fixed-price servers in two regions, never on usage-billed infrastructure, and we page ourselves before we page you. A missed check never triggers an action; only observed usage does.
It does, and you should turn it on. It checks every few minutes and pauses every project on your team at once, with manual resume per project. Vercel also has no real-time usage API — its billing endpoint is day-granular — so on Vercel we combine its spend webhook, its usage-anomaly alerts and a daily billing reconciliation, and act per project: promote a static deployment first, pause only if the slope keeps climbing. Cloudflare and Supabase live in the same rule. Use both.
No. We read usage counters and billing meters from platform APIs — request counts, bytes, CPU time, dollars. Never request bodies, never your database, never your users.