In January 2026, a developer paying Cloudflare $5 a month opened their inbox to a warning that their paid services were about to be switched off. The bill behind it was $4,868. Over a single weekend, two bugs in two separate Workers had written roughly 4.83 billion rows to D1, Cloudflare’s database. D1 charges a dollar per million rows written. Run that multiplication and the number stops being shocking. What’s shocking is that nothing, anywhere in the platform, put a hand up while it was happening.
The account owner, Nathan Schram, wrote the whole thing up. His conclusion is the part worth sitting with: Cloudflare’s billing notifications “aren’t granular enough to catch a worker writing a billion rows overnight.” The charge was eventually waived, after eighteen days of support tickets. The next person’s might not be.
The most-requested feature Cloudflare won’t ship
Search Cloudflare’s own community forum for “spending limit” and you’ll find the same request going back to 2020. Not “alert me” (people have asked for that too) but “stop me.” A hard cap. A number you set that the platform refuses to cross, even if honoring it means throttling your own Worker at 2am. The threads carry titles like “Setting up a spending Limit,” “Spending Limit,” “Setting spending limits per service category.” Different years, same ask.
The fear is specific and rational. Workers, R2, KV and D1 are billed by usage with no ceiling. A retry loop, a recursive trigger, or a crawler that finds your dynamic sitemap and requests all 380,000 pages can each turn a rounding-error bill into a mortgage payment while you sleep. Schram’s $4,868 is the loud version. The quieter ones fill the same forum: an $800 D1 bill from Google crawling a sitemap, a $6,781 read spike from a coding bug that sat unanswered for ten days, a $564 overage from a fix that landed a little too late.
The steelman for not having a cap
It’s easy to read all this as Cloudflare being careless. It isn’t, and it’s worth being fair about why.
A true hard cap is a genuinely dangerous feature to build. To enforce “$50 and not a cent more,” the platform has to do something the moment you hit $50: stop serving your traffic. For a hobby project, fine. For a company running its storefront on Workers, an automatic shutoff at a number somebody typed in six months ago is its own kind of outage, and the postmortem writes itself: “we took ourselves down to save $12.” That’s not obviously the better failure. Metered billing without a hard stop is a real design position, not laziness, and AWS, Google Cloud and Azure all landed in the same spot for the same reason.
But that argument only defends the missing kill switch. It says nothing about the missing early warning, and the early warning is where Cloudflare actually falls short.
Cloudflare did ship Budget Alerts in April 2026, and credit where it’s due, it beats the silence that came before. It’s also carefully declawed. One email. One number for the whole account. Pay-as-you-go plans only, no Slack, no per-service rule, no projection of where you’ll land by Friday, and nothing that pauses. It tells you the account crossed a line, sometime after it crossed it. And when Cloudflare wanted to give a product a real hard cap, it could: AI Gateway got genuine spend limits in 2026. Everything else you’re running did not.
What we actually do about it
SignalFlare is the early-warning half, built the way we’d want it if the bill were ours.
You connect a read-only Cloudflare API token, the kind that can look but can’t touch, and we poll your usage every few minutes. You set budgets per service, not just for the whole account: “tell me the moment R2 alone crosses $10” is a rule, not a wish. When spend bends the wrong way, the flare goes to the channel your team already has open, Slack or Discord or a webhook, in seconds instead of at end of day. And because we keep more history than Cloudflare’s roughly 31-day analytics window, we can say the thing Cloudflare’s own email can’t: at this rate you cross your $50 cap on Thursday, a week before the invoice.
That’s the whole pitch. Not a dashboard you’ll forget to open. A tripwire for the 3am spike.
The honest limits
House rule: we tell you where this cuts against us.
We show you an estimate, not your invoice. Cloudflare samples its analytics, so our dollar figures can drift a few percent from the real bill. For this job that’s the right trade, because at 3am you need direction and timing rather than cent-perfect accounting. It does mean the number on our screen is an early warning and never a receipt.
Then the big one. Today, we alert. We don’t stop the spend. If a Worker is writing a billion rows right now, SignalFlare will light up your Slack fast enough to matter, but you’re still the one who walks over and pulls the plug. The automatic kill switch, the thing that would actually cap you, is on the roadmap, and it will ride on a separate, opt-in write token. The read-only token you start with can’t change anything, by design, and we’re not going to quietly widen it. Until the kill switch ships, think of us as the smoke alarm, not the sprinkler.
One more, said plainly: if Cloudflare’s own budget email is genuinely all you need, use it and keep your $19. We’re for the case where “the account went over” isn’t enough, and you want to know that it was R2, specifically, that doubled in the last hour.
Cloudflare today. More soon.
Denial-of-wallet isn’t a Cloudflare quirk. It’s the shape of nearly every usage-priced platform that shipped without a hard cap, which is most of them.
| Platform | The bill that made the rounds | The gap |
|---|---|---|
| Netlify | A free static site ran up about $104,500 in four days when one file drew 60 TB of traffic. | No hard cap, and no alert while it climbed. |
| Vercel | A developer woke up to a roughly $23,000 bill after a DDoS; every attack byte was billed as normal bandwidth. | Alerts exist. A real spend cap is Enterprise-only. |
| Firebase / GCP | One unbounded query or a looping function can turn a $12 bill into thousands overnight. | Budget “alerts” email you after the money is gone. Still no hard limit. |
| AWS | Recursive Lambda-to-S3 loops are a whole genre. A weekend loop can outrun a year of planned spend. | Budgets alert, they don’t cap. Loop detection helps, and only for some services. |
We’re starting with Cloudflare because it’s where we live, and because its metering is quiet enough that people genuinely can’t see the bill coming. Vercel, Netlify and the rest are on the list. If your leak is somewhere else and you’d want us there sooner, tell us at hello@signalflare.dev; the order gets decided by who asks.
Sources
- The $4,868 bill: Nathan Schram, “My $5/month Cloudflare bill hit $4,868 because of an infinite loop,” littlebearapps.com (also on DEV). Roughly 4.83 billion D1 rows written; the D1 overage line was $4,586.64; waived after 18 days.
- The spending-limit ask, going back to 2020: Cloudflare Community threads Setting up a spending Limit, Spending Limit, and per-service limits.
- Other D1 overages: $800 from a Googlebot sitemap crawl, $6,781 read spike.
- Cloudflare Budget Alerts and AI Gateway spend limits: Cloudflare blog.
- Netlify ~$104k: Hacker News. Vercel ~$23k: write-up. Firebase budgets: Google’s own “avoid surprise bills” doc. AWS Lambda loops: Vantage.
SignalFlare watches your Cloudflare spend and fires a flare in your team’s Slack before the invoice does. Read-only token, two-minute setup, no card. Start free.