Shadow mode for abuse rules: turn on protection safely
Test abuse rules in shadow mode before they block anyone. Import your history, observe, replay changes against past traffic and switch to protect with confidence.
Turning on abuse protection has two ways to go wrong. Switch it on blind with rules that are too strict, and you deny real customers on day one, often the ones who were most excited to try your product. Wait too long, and every week of hesitation is another week of repeat claims, farmed credits and bills.
Shadow mode solves both. You run protection on real traffic, see every decision it would make, and only then let it act. In AbuseZero, shadow mode is called observe mode, and it comes with tools to test every change before it reaches a user.
The safe rollout, end to end
Import what you already know
Protection is only as good as the history behind it. Import the benefits you granted before AbuseZero, from code or a CSV file, so a user who already had a trial is recognized from the first evaluation. Without this, every existing user's second account looks brand new.
Run in observe mode
Set the benefit's mode to observe. Every claim is allowed, and each evaluation records what AbuseZero would have decided. Your users notice nothing. See protect and observe.
Review what would have been denied
Open the evaluations AbuseZero would have denied. Each one has an AbuseZero Risk Score, a readable reason and an association graph showing which earlier claims it connects to. Look for patterns that belong to real customers, and add them to an allow list.
Test every change before it's live
- Previews run one claim through the full evaluation without recording anything.
- Replays apply a different protection level or rule to your recent evaluations and show every result that would change. In the dashboard, it's Test against past traffic.
- Simulations run a sequence of claims, so you can see how a policy treats someone coming back again and again.
Replays and simulations use no credits, so you can test as often as you like. See test changes safely.
Switch to protect
When the results look right, set the mode to protect. Your code doesn't change.
Keep watching
Send denied evaluations to an alerting channel with a webhook, and review new patterns as your traffic changes.
See every decision before it counts
Observe mode, previews, replays and simulations are built into AbuseZero. Start with Builder or see pricing.
How long to observe
Long enough to see your normal traffic, and not so long that abuse runs unchecked. A few days covers most products. A week covers weekly patterns. If you're preparing for a launch, observe on beta or waitlist traffic and switch to protect before the launch goes live. Observing through a launch day means every claim on your busiest day is allowed. See going viral on X?
Remember that every evaluation in observe mode is real and uses credits, just like in protect mode.
Frequently asked questions
What is shadow mode for abuse rules?
Shadow mode runs your rules on real traffic and records what they would decide, without affecting any user. In AbuseZero it's called observe mode: every claim is allowed while each evaluation records what AbuseZero would have decided.
How do I test abuse rules before they go live?
Preview single claims, replay a change against your recent evaluations to see which results would change, and simulate sequences of claims. Then run in observe mode before you switch to protect.
Do replays and simulations cost credits?
No. Previews and evaluations, including those in observe mode, use credits. Replays and simulations don't.
Should I import my existing users first?
Yes. Importing the benefits you've already granted means people who already had a trial or credits are recognized from the first evaluation.
Turn on protection with confidence
Start with Builder
Pay as you go. Start in observe mode.
Test changes safely
Previews, replays and simulations in the docs.
See pricing
Builder, Pro, Scale and Enterprise.