WebStress is intentionally designed for authorized performance testing.

Controls implemented:

1. --authorized is mandatory for execution.
2. The target host must exactly match target.allowed_hosts.
3. Public targets can be configured to require an ownership token before load begins.
4. Redirects to non-allowlisted hosts are blocked.
5. Hard RPS and concurrency limits are validated before the run.
6. Runtime error/timeout/p99/dropped thresholds can automatically stop load.
7. Response bodies are capped by max_body_bytes.
8. Proxy environment variables are ignored unless use_proxy_env is explicitly enabled.
9. The live dashboard may bind only to loopback/localhost.
10. Report generation redacts request bodies, authorization/cookie/API-key style headers and ownership tokens.
11. Base URLs with embedded credentials are rejected.

Operational guidance:

• Prefer staging or a production-like isolated environment for destructive breakpoint tests.
• Coordinate test windows with application, network, database, CDN/WAF and observability owners.
• Start with smoke/baseline stages and ramp gradually.
• Set abort thresholds before the test, not after it has already damaged service quality.
• Verify the load generator's CPU/network/file-descriptor capacity and watch dropped load.
• If testing through a proxy/CDN/WAF, confirm that component is also in the authorized scope.