Eight Cloudflare bill spikes in 2026: unindexed D1 queries and a DO alarm loop to blame

·1 views

Eight cases of unexpected Cloudflare billing spikes were documented in 2026 across Cloudflare Community and Hacker News forums. Seven involved D1 database overages caused by full-table scans on unindexed columns, while one stemmed from a Durable Objects alarm handler that rescheduled itself in a continuous loop over eight days, costing roughly $34,895 with zero active users. The smallest stated bill among the cases was $176, and the largest single D1 invoice reached approximately $1,481 after 1.476 trillion rows were scanned. In each instance, the metered usage spiked by 10,000 times or more before the account holder noticed, typically only after receiving an invoice or quota alert. Cloudflare introduced Budget alerts in April 2026, but these are informational only and do not automatically pause or cap usage, meaning manual intervention is still required.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer finds all five modulation paths in his synth were broken after first measurement

A developer auditing SYNTH/1, their self-built JUCE wavetable synthesiser, discovered that five modulation paths — including the LFO, portamento, and unison summing — had never been measured and were all producing incorrect output. The core problem stems from control-rate code running once per audio buffer block, meaning the effective update rate varies with host buffer size, which can range from 32 to 4096 samples. At a 20 Hz LFO setting and large buffer sizes, the phase increment per block exceeds 1.0, causing the accumulator to grow without bound rather than wrap correctly, quietly degrading output over long sessions. One of the five errors was off by a factor of thirteen, yet none were audible during normal listening, highlighting how measurement catches what ears miss. All five issues have since been fixed by advancing the LFO on a fixed sub-block interval, decoupling its rate from the unpredictable host buffer size.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

NestJS Adventure API Part 3: Adding XP, Levels, and Badge Logic via Separate Services

The third installment of the Grimoire API series introduces gamification features including experience points, leveling, and badge unlocks to a choose-your-own-adventure NestJS application. Rather than expanding the existing ProgressService with additional conditionals, the developer extracted XP and badge logic into dedicated services to keep responsibilities clearly separated. XpService calculates player levels using a pure mathematical formula, requiring no database access and making it straightforward to unit test in isolation. BadgesService, by contrast, does query the database to prevent duplicate badge awards when a player revisits the same story page. This architectural split ensures that bugs in the leveling formula cannot interfere with how player progress is saved, and each service can be tested independently.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Send Python and PHP App Logs Directly to Loki via HTTP API

A hands-on guide demonstrates how to push application logs from Python and PHP mini-apps to Grafana Loki using its HTTP API endpoint POST /loki/api/v1/push. Unlike Prometheus, which pulls metrics, Loki receives logs actively from applications in a JSON payload containing stream labels and timestamped log lines. Loki deliberately indexes only a small set of low-cardinality labels rather than full log content, keeping storage costs low compared to tools like Elasticsearch. Log text is stored as compressed chunks and scanned at query time, making label-based filtering fast but free-text searches slower at high volumes. The article also warns that high-cardinality labels, such as unique user IDs per request, undermine Loki's efficiency in the same way they do in Prometheus.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why RAG Systems Should Filter Permissions Inside the Query, Not After It

A developer behind the open-source project vaultrag has highlighted a subtle but serious security flaw common in retrieval-augmented generation (RAG) systems built on Postgres and pgvector. The typical approach retrieves the top-k nearest vector chunks first and then removes results the user is not permitted to see, which creates two problems: relevant permitted content may never enter the candidate set, and upstream components like logs or caches can inadvertently expose forbidden data. The recommended fix is to embed access-control logic directly inside the SQL query using a common table expression (CTE) that restricts the chunk universe before any ranking or limiting occurs. A document-level ACL table maps content to user IDs or group principals, and those principals are resolved server-side to prevent clients from asserting their own permissions. With this structure, unauthorized chunks are never selected, ranked, or held in memory at any stage of the retrieval pipeline.

0 comments Read more at DEV Community