Live status of every worker, Telegram bot and the database.
Recently uploaded files pulling downloads fast (downloads per day since upload). A sudden spike can mean a leak doing the rounds — worth a look.
Scored by heuristics (filename, type, VPN, size, upload velocity). Higher score = more suspicious. Always verify before acting.
Change these without redeploying. The upload worker picks up new values within ~60 seconds.
Space or comma separated. The leading dot is optional — it's added automatically.
These limits are stored in KV as platform_config and read by every upload endpoint (preflight, /upload, /upload/v2). Lowering the max size or rate limit takes effect for new uploads almost immediately. Blocked extensions are rejected before the file is ever stored. The defaults are 500 MB, 500 uploads/hour and a curated executable blocklist.
Block uploads from entire countries — handy when spam pours in from many IPs in one region. Detection uses Cloudflare's edge geo-IP and changes apply within ~60 seconds. Downloads are unaffected; this blocks both anonymous and account uploads originating from the selected countries.
Newest first. Anonymous uploads are recorded for 30 days; account uploads are kept while the file exists.
Every admin action, newest first. Retained for 90 days.
Every file you've blocked, with its reason and when. Unblocking lifts the download block — it does not restore content that was permanently deleted at block time.
Every upload is fingerprinted with a SHA-256 hash on the server. If a file's fingerprint is on this list, the upload is rejected before it's ever stored — so confirmed material (e.g. CSAM) can never be re-uploaded, even renamed. The fastest way to add one is the “Also prevent re-upload” checkbox in the Block dialog. Note: this matches byte-identical files only; a re-encoded/re-compressed copy has a different hash.
One SHA-256 hash per line (64 hex characters). Use this when you already have a hash to block.
One-click responses. Use these the moment you suspect an attack.
Require a one-time code from an authenticator app on top of your admin key. Generate a secret, add it to your app, then set it as the ADMIN_TOTP_SECRET environment variable on this Worker and redeploy. 2FA is only enforced once that variable is set — generating a secret here can't lock you out.
Give a plan for a while, for example a month of Plus for new accounts. People claim it in their dashboard: a gift in the sidebar, and a window that opens once. When a gift ends, the account goes back to its own plan, and files set to Forever get 30 days, like any plan that ends.