Vercel free plan limits exceeded overnight

Hi,

I worked on my app for 3-4 months while deployed on Vercel with 0 issues. Yesterday I started Beta testing, launched app on a custom domain, set Clerk to production, activated Google OAuth in dev console. Everything worked fine during the day.

Woke up today to a paused deployment and inbox full of "Your site is growing" emails. My app has 2 DB users and 3 records total.

**Vercel project dashboard showing me this:**

- Function Invocations: 2.1M / 1M

- Edge Requests: 1.4M / 1M

- Fast Origin Transfer: 29.4 GB / 10 GB

**What I found in Vercel logs:**

Thousands of requests hitting URLs like:

```

GET 307 /clerk_1778520375205

GET 200 /en/clerk_1778520375205

GET 200 /en/clerk_1778540283003/terms

GET 307 /clerk_1778540283003/terms

```

These look like Clerk userIds, but none of them match one of 2 IDs from db. The numbers appear to be Unix timestamps in milliseconds from yesterday evening.

My **middleware.ts** (proxy.ts) redirects any path without a locale prefix to `/en/[path]`, so every bot request = 2 invocations (307 + 200).

**App structure:**

```

/app/[lang]/(home)/

/app/[lang]/(dashboard)/training/[id]

/app/[lang]/(dashboard)/insights/[insightId]

```

Using Clerk for auth. No generateStaticParams, no sitemap.ts. Clerk dashboard shows no events during that time. Google Search Console also clean.

**Questions:**

1. Where could these `/clerk_XXXXXXXXX` URLs come from?

2. Is this what caused the limit exceeded?

3. How do I protect against this on the free plan?

4. Is there a way to block unknown path patterns in middleware efficiently?

I plan to move to Pro eventually, but for 5-10 beta users I'd like to stay on free to validate the app first.

Thanks