DDoS Attack - 2.18M requests not auto-blocked on Hobby plan

Help
,
1

Current versus Expected behavior

Current behavior:

My project received approximately 2,189,216 requests in a short period, which appears to be a Layer 7 DDoS attack. Vercel’s platform did not automatically detect or block this malicious traffic, resulting in the requests being counted against my Hobby plan quota.

1000119104
10001191041280×1302 153 KB

1000119102
1000119102858×113 4.42 KB

Expected behavior:

I expected Vercel’s DDoS protection to automatically identify and mitigate this abnormal traffic pattern before it consumed my monthly request quota.

Code, configuration, and steps that reproduce this issue

  1. Project was deployed and running normally

  2. Suddenly received a massive spike of 2.18M+ requests

  3. Checked the Usage dashboard and confirmed the traffic spike

  4. Manually created and enabled a rate limit rule: “Rate limit static site to 100 req/10min”

  5. Published version #1 with this change

Current Firewall Configuration:

  • Rate Limit Rule: 100 requests per 10 minutes (enabled after attack)

Project information

  • Project Name: vibe-chat

  • Plan: Hobby (Free)

  • Total Requests: 2,189,216

  • Time Period: Last 90 days (Mar 30 - Jun 28)

  • Mitigation Applied: Rate limiting rule (100 req/10min)

Questions

  1. Why wasn’t this traffic pattern automatically detected and blocked?

  2. Will I be charged or soft-blocked due to exceeding Hobby limits from this attack?

  3. What additional protective measures can I take within the Hobby plan’s 3 custom WAF rules limit?

Thank you for any guidance!

2

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: Report Abuse On Vercel

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

3

New DDOS request has been sended. 1m requests sent successfully with no deny and my project get pause

4

Were the visits from verified bots? Can we see the graph?