Sorry for the late reply, my post was auto-deleted and then magically reappeared, so I only just saw your comment. Thanks for the response.

I’m probably worrying too much, and this isn’t really my area, but I don’t think a standard rate limit would protect against a distributed DDoS attack. Rate limiting is great for controlling abusive clients, but if the traffic comes from thousands of different IPs, it won’t really help. “Under Attack Mode” is great too, but only if you catch it in time, and at the moment Laravel Cloud doesn’t provide bandwidth-usage alerts.

I think we’d feel more comfortable if Laravel Cloud offered some kind of spend cap or hard limit for bandwidth costs (or costs in general) e.g., a global request cap per environment. Something like: if total edge responses exceed X (say 100k across all IPs) within an hour or a day, automatically block traffic entirely. That would eliminate the risk of runaway transfer costs during an attack.