Guardrails, live

Each button sends a real request to the live endpoint. None of these store a submission.

Wrong write key

The URL names the site, but only the key authenticates. Expect 403.

Open-redirect attempt

A plain HTML form asks to send the visitor to https://evil.example/ afterwards. Only exact allowlisted pages are allowed, so a new tab shows the Worker’s 400 Bad Request instead of the other site.

Bot fills the honeypot

A hidden field humans never see. Bots get a normal-looking success so they don’t adapt — but nothing is stored. Expect a fake 201.

Oversized field

A single 70 KB value, above the 64 KiB per-field limit. Expect 400 field_value_too_long.

Flood from one visitor

35 rapid bot posts. After 30 in a minute the endpoint answers 429. This blocks your own browser for up to a minute.