WAF, DDoS protection, and automated abuse
Hosting and edge platforms provide capabilities for web application firewalls, denial-of-service protection, and bot mitigation. Which controls apply depends on the hostname, request path, provider plan, and deployed rules. Application rate limits and validation add another boundary.
A vendor review can request the current edge-control configuration and HTTPS coverage for the relevant public and API surfaces. Do not treat the presence of Cloudflare in a provider list as proof that every request traverses a particular WAF rule.
Protected connections
The public service uses HTTPS. Hosting and edge providers supply network protections, while the application applies request validation and feature specific limits to reduce misuse.
Safe boundaries for remote content
Research features may retrieve public pages. Fetching untrusted URLs needs checks on the destination and response so a public research request cannot become access to private infrastructure. Public retrieval and authenticated provider requests use different boundaries.
Browser protections
Response security headers and content policies help restrict how pages load resources and interact with other origins. These work alongside authorization checks; they are not substitutes for account or record permissions.