Skip to content

feat(web): guard the voice demo route against bots - #10

Merged
coder-RT merged 1 commit into
mainfrom
dev
Nov 1, 2026
Merged

coder-RT merged 1 commit into
mainfrom
dev

Conversation

@coder-RT

@coder-RT coder-RT commented Nov 1, 2026

Copy link
Copy Markdown
Owner

The only route that spends money (Muse Voice Transcribe) now:

  • answers only this site's pages (Origin must match the host);
  • is rate-limited per visitor by the Vercel firewall rule 'voice-transcribe' (@vercel/firewall 1.2.6, Apache-2.0), with a per-instance fallback if the rule isn't set up or can't be reached;
  • never keys on X-Forwarded-For, which a client can write;
  • has a daily cap (VOICE_DAILY_CAP, default 300) and an off switch (VOICE_DEMO=off). Each refusal has a visitor message. Guards are tested on their own.

The only route that spends money (Muse Voice Transcribe) now:
- answers only this site's pages (Origin must match the host);
- is rate-limited per visitor by the Vercel firewall rule 'voice-transcribe' (@vercel/firewall
  1.2.6, Apache-2.0), with a per-instance fallback if the rule isn't set up or can't be reached;
- never keys on X-Forwarded-For, which a client can write;
- has a daily cap (VOICE_DAILY_CAP, default 300) and an off switch (VOICE_DEMO=off).
Each refusal has a visitor message. Guards are tested on their own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@vercel

vercel Bot commented Nov 1, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
recall Ready Ready Preview Nov 1, 2026 12:59am UTC

@coder-RT
coder-RT merged commit 4777718 into main Nov 1, 2026
7 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant