Security

Per-site security controls.

Status: skeleton

Full content lands in a follow-up pass.

Rate limiting

Default per-IP request rate cap. Tor traffic is hashed by circuit ID rather than client IP (we don't see Tor client IPs).

IP allow / deny

Optional. Useful for:

• Pre-launch sites that should only be reachable from internal networks
• Geo-restricted content (apply at the application layer; we don't do GeoIP)

JWT-at-edge

The edge can validate signed JWTs before forwarding to your origin. You configure:

• Public key (RS256/ES256/EdDSA) or shared secret (HS256)
• Required claims (issuer, audience, custom)
• Where to find the token (cookie, Authorization header, query param)

Failed validations get 401 without ever hitting your origin. See the JWT-at-edge how-to.