TL;DR: RugRadar scans tokens across Ethereum, BSC, Polygon, Arbitrum and Base for honeypots, mint authority, owner concentration and liquidity traps. It runs entirely on Cloudflare's free tier with Workers KV, no SQL database, no servers, zero monthly cost. Here is the architecture and the parts that surprised me.
Architecture in one paragraph
A single Worker serves static assets (public/) and a JSON API (/api/*). Risk telemetry comes from GoPlus's free token-security endpoint; scoring is local, pure, and unit-tested so every finding maps to a concrete contract behavior. KV stores licenses, invoices, scan cache (6h TTL), soft rate-limit counters and daily metrics. Payments run on two rails: Stripe Payment Links (card), and a fully self-custody USDC-on-Base flow where a cron poller watches public-RPC transfer logs and auto-issues license keys. No email anywhere: keys are delivered on-page.
Surprise #1: GoPlus returns HTTP 200 when it rate-limits you
The failure mode that cost me the most debugging time: from Cloudflare's shared egress IPs, GoPlus sometimes answers 200 OK with body {"code": 4029} — rate limited. If you check HTTP status only, everything "works" while every scan dies.
Fixes that made it robust:
- retry once with jitter on
code: 4029 - stale-if-error: serve the last stored report (flagged as stale in the UI) rather than failing
- versioned cache keys (
v2:) so schema changes invalidate cleanly
Surprise #2: workers.dev embeds your account name
The default *.workers.dev URL contains your account-level subdomain. For a pseudonymous product that is an identity leak you cannot rename (the subdomain is set once per account). Solution: attach a custom domain to the Worker — free on any zone already in your account — and disable the workers.dev route.
Surprise #3: You do not need D1
KV gets dismissed for anything relational, but licenses map naturally to keys: lic:<key> for records, idx_stripe:<session> for idempotent fulfillment lookups, inv:<id> for invoices. Rate limiting on KV is eventually consistent — useless for billing precision, perfectly fine for abuse ceilings.
Scoring honestly
Every finding maps to a mechanism (honeypot simulation, mint capability, top-LP concentration, modifiable taxes...). Unknowns lower the score instead of being ignored — conservative by design. A clean renounced token scores ~80-100; a mintable token with single-wallet liquidity lands in DANGER territory regardless of how nice its chart looks.
Costs
$0/month: Workers free tier (100k req/day), KV free tier, GoPlus free endpoint, Stripe has no fixed fee. The only non-zero thing ever spent was my time.
If you want to poke at it: rugradar.datanest-stores.com. Scan your favorite bag; disagree with the machine in the comments — the findings link their reasoning precisely so you can.
Top comments (0)