How this is built.

1. SSR HTML + islandsThe browser asks for the page.
2. Vercel WAFThe Vercel WAF sees nothing odd and lets it through.
3. Cached CDNThe CDN has no fresh copy (MISS): the page has to be built.
4. Node functionsA Vercel Node function wakes up.
5. One canonical pathThe middleware strips the language and trailing slash: every guard sees the canonical path.
6. Micro-SIEMThe micro-SIEM sensor classifies it: normal traffic.
7. Public siteAstro renders the public page on the server.
8. Reads on a budgetIt reads the daily monitor summary, not raw rows: Turso bills rows scanned.

200 · MISSThe response stays in the CDN for 5 minutes: this request paid for the SSR of the next ones.

1. SSR HTML + islandsThe browser asks for the page.
2. Vercel WAFThe Vercel WAF sees nothing odd and lets it through.
3. Cached CDNThe CDN holds a copy under 5 minutes old (HIT) and answers by itself.

200 · HITNo function, no database: the SSR was paid once and served many times.

1. Vercel WAFThe user-agent belongs to an attack tool: the WAF cuts it at the edge, without waking any function.

403It dies before costing a single invocation.

1. Vercel WAFThe path smells like probing, but that WAF rule only logs: blocking here would blind the in-house sensor.
2. Cached CDNNothing to serve from cache.
3. Node functionsA Vercel Node function wakes up.
4. One canonical pathThe middleware strips the language and trailing slash: every guard sees the canonical path.
5. Micro-SIEMThe sensor recognises a hunt for secrets and logs it in the micro-SIEM.
6. Public siteNothing lives at that path: 404.

404It gets a 404 and is on record. If it insists, rate limiting and escalating blocks do the rest.

1. SSR HTML + islandsThe browser asks for the page.
2. Vercel WAFThe Vercel WAF sees nothing odd and lets it through.
3. Cached CDNNothing to serve from cache.
4. Node functionsA Vercel Node function wakes up.
5. One canonical pathAn /en/ in front of a private route has no translation: 404 before anything else.

404Neither the sensor nor the session check gets to run: the panel has no English copy.

1. SSR HTML + islandsThe browser asks for the page.
2. Vercel WAFThe Vercel WAF sees nothing odd and lets it through.
3. Cached CDNPrivate route: the CDN keeps no copy and lets it through.
4. Node functionsA Vercel Node function wakes up.
5. One canonical pathThe middleware strips the language and trailing slash: every guard sees the canonical path.
6. Micro-SIEMThe micro-SIEM sensor classifies it: normal traffic.
7. Panel authGitHub session on the allowlist and, according to Turso, not revoked.
8. /admin panelThe panel is rendered, cached nowhere.
9. Two databasesQueries go to the production database.

200Private 200, uncached and with hardened headers.

1. SSR HTML + islandsThe browser asks for the page.
2. Vercel WAFThe Vercel WAF sees nothing odd and lets it through.
3. Cached CDNPrivate route: the CDN keeps no copy and lets it through.
4. Node functionsA Vercel Node function wakes up.
5. One canonical pathThe middleware strips the language and trailing slash: every guard sees the canonical path.
6. Micro-SIEMThe micro-SIEM sensor classifies it: normal traffic.
7. Client portalThe portal has its own cookie, checked against its own sessions table.
8. Two databasesEvery query filters by the client in the session, never by one coming from the URL.

200The client only sees what is theirs.

1. SSR HTML + islandsThe browser asks for the page.
2. Vercel WAFThe Vercel WAF sees nothing odd and lets it through.
3. Cached CDNPrivate route: the CDN keeps no copy and lets it through.
4. Node functionsA Vercel Node function wakes up.
5. One canonical pathThe middleware strips the language and trailing slash: every guard sees the canonical path.
6. Micro-SIEMThe micro-SIEM sensor classifies it: normal traffic.
7. Panel authNo session, but a signed demo pass (HMAC): it gets in read-only.
8. Public demoThe real panel is rendered, in demo mode.
9. Two databasesQueries come from the demo database, a separate one, with made-up data.

200The real panel, with made-up data.

1. SSR HTML + islandsThe browser asks for the page.
2. Vercel WAFThe Vercel WAF sees nothing odd and lets it through.
3. Cached CDNPrivate route: the CDN keeps no copy and lets it through.
4. Node functionsA Vercel Node function wakes up.
5. One canonical pathThe middleware strips the language and trailing slash: every guard sees the canonical path.
6. Micro-SIEMThe micro-SIEM sensor classifies it: normal traffic.
7. Panel authThe vault reveals secrets and it is a GET: the demo bans it by pattern. 403.

403"Read-only" was not enough: a GET can reveal things too.