- Starting a stream before calling protect() — if the request is denied mid-stream
the client gets a broken response. Always call protect() first and return an error before opening the stream.
Explore
138,615 skills indexed with the new KISS metadata standard.
the client gets a broken response. Always call protect() first and return an error before opening the stream.
not in Next.js pages or server actions.
return the error before opening the stream — don't start streaming and then abort.
independent of the model provider.
suggest the /arcjet:security-analyst agent which can investigate traffic
filter by conclusion to see blocks
promote to LIVE.
res.status(429).json(...) for Express).
decision.reason.message);
{ status: 403 });
// injection detection
// tokens to deduct for rate limiting
{
// PII scanning
consider adding Arcjet advanced signals for client-side bot detection that catches sophisticated headless browsers. See https://docs.arcjet.com/bot-protection/advanced-signals for setup.
deduct 1 token per message
defaults to IP-based.
directly linking rate limiting to cost. It also allows short bursts while enforcing an average rate
SensitiveInfoType.CREDITCARDNUMBER
PII leakage
role-play escapes
set one up first with shield() as the base rule. The user will need to register for an Arcjet account at https://app.arcjet.com then use the ARCJET_KEY in their environment variables.
rule types
PII blocking