{"id":98034,"date":"2026-10-07T10:14:00","date_gmt":"2026-10-07T14:14:00","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=98034"},"modified":"2026-09-29T07:57:19","modified_gmt":"2026-09-29T11:57:19","slug":"emdash-bug-report-billing-risk-98034","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/emdash-bug-report-billing-risk-98034\/","title":{"rendered":"EmDash\u2019s 0.1.0 Bug Report: The Real Risk Isn\u2019t the Bugs \u2014 It\u2019s the Bill"},"content":{"rendered":"<p>The most dangerous thing about Cloudflare\u2019s new CMS isn\u2019t a broken feature or missing plugin. It\u2019s that you can wake up to a $13,000 bill with no built-in kill switch. That\u2019s the counterintuitive truth about <a href=\"https:\/\/em-dash.com\" target=\"_blank\" rel=\"noopener noreferrer\" data-iacss-external=\"1\">EmDash<\/a> 0.1.0. Every page view, admin click, and API call hits Cloudflare Workers\u2019 per-request pricing. There\u2019s no spending cap. And unlike WordPress hosting\u2019s flat $20\/month, this serverless model charges you for every millisecond of CPU time and every database read.<\/p>\n<p>Early testers are discovering bugs \u2014 authentication failures, content loss, broken previews \u2014 but those are fixable. The billing model is architectural. It\u2019s the feature, not a bug. And it\u2019s the one thing most coverage misses.<\/p>\n<h2>What\u2019s Actually Broken in EmDash 0.1.0<\/h2>\n<p>Let\u2019s be specific. This is a version 0.1.0 beta \u2014 89 commits on GitHub, built in about two months with heavy AI assistance. Bugs are expected. But some are showstoppers for production use.<\/p>\n<ul>\n<li><strong>Passkey authentication fails on Linux.<\/strong> The magic-link fallback returns a 404 page not found error. If you\u2019re running a Linux dev environment, you may not be able to log in at all.<\/li>\n<li><strong>Multi-tab editing loses content.<\/strong> One tester found that opening the same page in two tabs causes one to reset the other\u2019s changes. For a CMS, losing a writer\u2019s work is unforgivable.<\/li>\n<li><strong>Front-end preview is not live.<\/strong> Changes saved in the editor don\u2019t appear in preview without a manual refresh. Draft preview works, but not real-time.<\/li>\n<li><strong>Custom content types are stored in the database, not code.<\/strong> You can create new content types from the admin UI, but there\u2019s no way to define them in Astro config or deploy them as code. That\u2019s a regression from modern headless CMS patterns where schema is version-controlled.<\/li>\n<li><strong>The WordPress import tool is basic.<\/strong> It migrates posts, pages, and media, but not plugins, themes, custom blocks, or WooCommerce data. If you have a complex site, you\u2019re rebuilding from scratch.<\/li>\n<\/ul>\n<p>These are real problems. But they\u2019re also the kind of problems a young project can fix in weeks. The billing problem is different.<\/p>\n<h2>The $13,000 Bill: How Serverless Pricing Can Backfire<\/h2>\n<p>Here\u2019s the math that matters. EmDash on Cloudflare\u2019s paid plan starts at $5\/month and includes 10 million Worker requests. After that, you pay $0.30 per additional million requests plus CPU time. D1 database reads are billed per row. R2 storage charges per operation. KV lookups add up.<\/p>\n<p>One page view can trigger four or five separate billing meters. A DDoS attack from 10,000 IPs, each making one request <a href=\"https:\/\/overcentral.com\/en\/meta-launches-zgateway-proxy-handles-1-billion-ops-per-second\/\" title=\"Meta Launches ZGateway Proxy, Handles 1 Billion Ops Per Second\" data-iacss-internal=\"1\">per second<\/a>, racks up 26 billable requests in a month \u2014 and that\u2019s just the start. Cloudflare offers no global spending cap. You can set CPU time limits per request and configure WAF rate limiting, but those don\u2019t cap total requests. A distributed bot attack goes right through them.<\/p>\n<p>A forum user calculated the scenario: 10,000 APIs \u00d7 1 req\/sec \u00d7 <a href=\"https:\/\/overcentral.com\/en\/ai-influencers-fail-30-days-96592\/\" title=\"Why Most AI Influencers Fail to Earn in 30 Days\" data-iacss-internal=\"1\">30 days<\/a> = 26 billion requests. At $0.30 per million after the free tier, that\u2019s $7,800 just in Worker requests, plus database and storage charges. Total: $13,000 or more.<\/p>\n<p>WordPress hosting charges a flat fee. Your server might crash under load, but your bill stays the same. EmDash flips that. The CMS keeps running perfectly under attack \u2014 and your credit card keeps getting charged.<\/p>\n<h2>The Plugin Sandbox: Great Idea, But Paid Only<\/h2>\n<p>EmDash\u2019s headline feature is the plugin sandbox \u2014 every plugin runs in its own V8 isolate, with declared capabilities. A plugin that declares <code>read content<\/code>codecodecode and <code>send email<\/code>codecodecode literally cannot do anything else. No database access, no file system, no network calls unless granted. That\u2019s a genuine architectural improvement over WordPress, where every plugin has full access to everything.<\/p>\n<p>But here\u2019s the catch. The sandbox requires Cloudflare\u2019s <strong>dynamic workers<\/strong>, which are only available on the paid Workers plan ($5\/month). On the free tier, plugins run in-process \u2014 no isolation, no sandbox. If you self-host EmDash on a regular Node.js server, there\u2019s no sandbox support at all. The feature that justifies EmDash\u2019s existence is locked behind Cloudflare\u2019s proprietary runtime.<\/p>\n<p>Cloudflare says the code is MIT licensed and you can run it anywhere. But the security model is not portable. That\u2019s not lock-in by license \u2014 it\u2019s lock-in by runtime.<\/p>\n<h2>The Ecosystem Void: Zero Plugins, Zero Themes, Zero Community<\/h2>\n<p>WordPress has 60,000+ plugins, 10,000+ themes, and millions of developers. EmDash 0.1.0 has zero third-party plugins. The built-in form plugin is rudimentary \u2014 \u201creminiscent of forms back in 2002,\u201d as one tester put it. There\u2019s no SEO plugin, no page builder, no e-commerce, no membership system.<\/p>\n<p>Cloudflare\u2019s counter-strategy is AI: every EmDash instance ships with an MCP server and agent skills files, so AI coding tools can generate plugins and themes programmatically. That\u2019s a clever approach, but it assumes the user is comfortable with TypeScript and CLI tools. For the average WordPress site owner managing 12\u201315 plugins, that\u2019s a non-starter.<\/p>\n<p>History is brutal. Ghost launched over a decade ago with better technology than WordPress. It has 0.1% market share. Craft CMS, Statamic \u2014 technically excellent, ecosystem-starved. EmDash is starting from zero.<\/p>\n<h2>The Second-Order Effect Most Coverage Misses<\/h2>\n<p>Every article compares EmDash to WordPress on security and cost. But the deeper implication is this: <strong>EmDash shifts the economic risk of running a CMS from the hosting provider to the site owner.<\/strong><\/p>\n<p>With WordPress, you pay a predictable monthly fee. If you get hacked, the host may help restore your site. With EmDash, you pay per request. If you get attacked, you pay more. The platform has no incentive to stop the attack \u2014 it keeps serving requests and billing you. The only way to prevent runaway costs is to monitor Cloudflare dashboards daily and configure WAF rules yourself. That\u2019s work most small publishers and bloggers don\u2019t have time for.<\/p>\n<p>WordPress\u2019s flat-rate model is a feature, not a bug. It\u2019s predictable. EmDash\u2019s serverless model is cheaper at low traffic, but unpredictable at scale. For a business that can\u2019t absorb a surprise $13,000 charge, that\u2019s a dealbreaker.<\/p>\n<h2>Who Should Actually Use EmDash Right Now?<\/h2>\n<p>Honestly? Almost nobody in production.<\/p>\n<p>If you\u2019re a developer experimenting with TypeScript and Astro, spin up the playground. It\u2019s free for an hour. Try the admin UI, test the block editor, see how portable text works. But don\u2019t put a client\u2019s site on it.<\/p>\n<p>If you\u2019re a small business owner or blogger, stick with WordPress. Keep your plugins updated, run backups, use a decent host, and run a security scanner. Those four things eliminate the practical risk EmDash is designed to solve \u2014 without the billing uncertainty.<\/p>\n<p>If you\u2019re an agency, EmDash has no agency tooling, no white-label options, no client portal, no staging workflow. WordPress offers all of that today.<\/p>\n<p>Cloudflare could build a real ecosystem in 12\u201318 months. They could add spending caps, improve the import tool, and grow a plugin marketplace. But right now, EmDash is a proof of concept with a dangerous pricing model.<\/p>\n<p>The bugs will be fixed. The billing model won\u2019t.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The most dangerous thing about Cloudflare\u2019s new CMS isn\u2019t a broken feature or missing plugin. It\u2019s that you can wake up to a $13,000 bill with no built-in kill switch. That\u2019s the counterintuitive truth about EmDash 0.1.0. Every page view, admin click, and API call hits Cloudflare Workers\u2019 per-request pricing. There\u2019s no spending cap. And [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":99380,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/98034.png","fifu_image_alt":"EmDash\u2019s 0.1.0 Bug Report: The Real Risk Isn\u2019t the Bugs \u2014 It\u2019s","footnotes":""},"categories":[31],"tags":[],"class_list":["post-98034","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology"],"fifu_image_url":"https:\/\/cards.overcentral.com\/cards\/en\/98034.png","fifu_image_alt":"EmDash\u2019s 0.1.0 Bug Report: The Real Risk Isn\u2019t the Bugs \u2014 It\u2019s","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/98034","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=98034"}],"version-history":[{"count":1,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/98034\/revisions"}],"predecessor-version":[{"id":99381,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/98034\/revisions\/99381"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/99380"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=98034"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=98034"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=98034"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}