Really? Is this right? I know nothing to be able to question - but it does seem to be an extreme that I would have heard about before?

The real problem is that Vercel doesn’t let you set a spending limit. Someone could DoS your app while you’re asleep and you’d wake up to a $10,000 bill with no recourse. It’s 2026 — AI crawlers and bots are everywhere, constantly hitting endpoints, triggering serverless functions. Vercel charges for CPU execution time, not bandwidth, so every bot visit costs you money. This isn’t a theoretical edge case. I couldn’t justify the risk anymore.

💬 Assaf Arkin

🔗 coolify-deploy — Vercel-style deploys on your own hardware — Labnotes