Every app you deploy on White Ghost sits behind the Ghosty platform's protective edge. It is on for every workspace, needs no setup, and quietly deals with most of the internet's background noise before it ever reaches your app.

What the edge blocks for you

• Injection probes. Requests that try to sneak database commands, scripts, or file-system tricks into your app's pages and APIs are stopped at the edge with a 403.
• Scanners. Automated vulnerability scanners that sweep the internet looking for weak spots are recognized and turned away.
• Floods. Abnormally rapid streams of requests from a single visitor are detected at the edge; further requests get a 429 and the visitor is paused briefly before they can try again. Normal browsing never comes close to triggering this.

Blocked traffic never reaches your app, so it doesn't wake it, slow it down, or show up in its logs.

What it deliberately does not do

The protective edge filters hostile traffic — it cannot fix application logic. It is not a substitute for:

• Sign-in and permissions. If a page should only be visible to some users, your app must check that itself.
• Input validation. Your app should still treat every input as untrusted, even though obvious attack patterns are filtered upstream.
• Business rules. Who may do what, and how often, inside your app remains your app's decision.

If a legitimate request is blocked

Very unusual — but legitimate — requests can occasionally look like an attack pattern (for example, a form field containing raw code). If something you or your users do keeps getting a 403 or 429 that you believe is legitimate, contact support: the protection can be tuned for your workspace.