Traditional denial of service tries to take your app down. On modern pay-per-use infrastructure there is a nastier variant: the app stays up and the bill goes vertical. It is called Denial of Wallet, and for a solo founder it can be worse than downtime.
Why serverless changes the threat
When you pay per invocation, per request, or per token, cost becomes an attack surface. A function that calls itself, a retry with no backoff, or an unbounded fan-out does not error out. It scales, exactly as designed, and each scale-up is a line on your invoice.
The patterns that cost money
- Recursive functions or event loops with no stop condition.
- Retries without exponential backoff or a cap, turning one failure into a storm.
- Unbounded fan-out, where one request spawns thousands.
- Expensive AI or third-party calls with no rate limit or budget guard.
- Missing idempotency, so a client retry doubles the work and the cost.
An attacker does not need to breach you to hurt you. They just need to make you pay for traffic.
Guarding the wallet
Set hard budget alerts at the provider level. Cap concurrency and add backoff to every retry. Rate-limit anything that triggers a paid downstream call. And review your code for the loop, retry, and fan-out patterns before you deploy, because the first time you find them should not be on your credit card statement.