What running headless Chrome against the real web actually involves. Every number measured; every bug one we shipped or nearly did. RSS
Three layers of abuse limits for traffic nobody pays for - signups per IP, renders per target domain, and a budget measured in slot-seconds - plus the billing bypass I shipped to production and found by accident.
SSRF when strangers choose the URL - private ranges in both IPv6 spellings, re-checking every redirect hop, the cloud metadata address, signed URLs so a key can live in public HTML, and the DNS rebinding gap I have not closed.
What a 1-core, 2 GB VPS actually does with headless Chrome - measured slot-seconds per render, a paid-first queue, the free-tier budget that protects it, and the honest limits of a single box.
The benchmark behind Screenshotline - 202 real sites, every page tagged ok or known-hard in advance, blank frames failing the run, and why a captcha that scores as a pass is the reason someone still has to open the image.
Why a screenshot API also returns Markdown, and why the extraction runs in the live DOM instead of parsing saved HTML - computed layout, shadow roots, link-wrapped headings, and the settle budget that decides whether you get 446 characters or 48,755.
Running Screenshotline on your own server - the compose file line by line, sizing the browser pool, locking it down with keys and signed URLs, HTTPS with Caddy, and when the hosted version is the better deal.
Almost every failure was a 200 with the wrong picture in it. What 202 real websites taught me about consent banners, network idle, wedged pages, ad holes, blank captures and zombie Chrome - with the code.