Protectd: Evolving Vercel’s always-on denial-of-service mitigations

This post introduces Protectd, Vercel's new real-time security engine for DoS mitigation. It details the evolution from a four-phase, polling-based system to an edge-based, stream-processing architecture using Golang. Key technical contributions include: moving detection to the edge for faster Time to Mitigation (TTM), replacing polling with direct event streams, using probabilistic data structures and JIT/SIMD for high-throughput event processing (~550K events/sec on 14 cores), implementing shadow mode and percentage-based rollouts for safe rule deployment, and enabling historical traffic replay for backtesting. The post quantifies the TTM improvement, achieving P99 of 3.5s and P50 of 2.5s, with response times as low as 0.5s.