BugSmash's free drop feature took 37.1 million requests

BugSmash shipped drop, an instant file-to-URL hosting tool, then shut it down after 37.1 million requests in 24 hours, per r/SaaS.

The number is the story: 37.1 million requests against infrastructure a solo founder likely sized for a SaaS side project, not a CDN. Founders shipping fast with AI are finding out the abuse surface grows just as fast as the build speed.

Cloudflare and Netlify run similar drop tools and can absorb that kind of traffic because they operate networks built for it. BugSmash built to the same pattern without that headroom.

An unauthenticated endpoint that turns any file into a live URL is a ready-made target for phishing pages, malware staging, or link farms. Automated traffic finds tools like this fast, whether or not that's what hit BugSmash.

The post on r/SaaS doesn't say what made up the 37.1 million requests, curiosity, a bot swarm, or something adversarial. That gap matters. Without it, there's no way to know if this was a traffic spike or an attack.

An indie founder can't self-insure against internet-scale abuse, so any unauthenticated instant-hosting endpoint needs a kill switch built before launch, not after traffic forces one.