Cloudflare Workers — the whole thing is a single stateless worker in front of a vector index, so I get TLS, DDoS filtering and bot scoring at the edge without running any infra myself. The tradeoff is you're limited to what the platform exposes; something like a gateway with pluggable security policies would matter more once there are write-capable tools involved. Mine is read-only search, which keeps the attack surface pretty boring — probably why my logs are mostly scanners looking for a WordPress that doesn't exist. Thanks for the Kong pointer, will take a look.