SaaS & B2B Apps
Your API powers the product. Your uptime SLA commits you to availability. Bot-driven abuse drains compute and erodes trust before a real user notices.
Specific threats.
API Endpoint Abuse
High-frequency requests exhaust your rate limits, database connections, and compute. A per-IP request limit stops one address from draining the API. Per-route and per-user limits are not in the current release.
Account Takeover
Credential stuffing on login endpoints. A per-IP request limit cuts off fast bulk attempts. Slow attempts spread over many IPs stay under it.
Trial Abuse
Bots create mass free accounts to extract product value without paying. Registration flow protection catches automated signup patterns before completion.
Data Harvesting
Systematic enumeration of object IDs, bulk export requests, and API response scraping. Schema validation and behavioral analysis catch the patterns.
What SaaS requires specifically.
- ✓ The browser check shows nothing by default: the sensor level only logs who would be checked
- ✓ API key consumers are recognized and excluded from bot throttling
- ✓ Webhooks from Stripe, GitHub, Slack, etc. whitelisted by signature
The goal they can't find.
Defense in the dark. No credit card. No footprint.