Load you can only aim at yourself.
Some load tests look exactly like attacks. These rules are built in, and no scenario file can switch them off.
Prove ownership
Private and loopback hosts just work. Public hosts stay under low caps until a DNS TXT record or a well-known file proves you own them.
Requests stay home
A scenario can only reach the target, private hosts and hosts you allow. Anything else is blocked and reported.
Hard limits
Server-wide and per-target caps on rate, users and duration, checked before a run starts.
Kill switch
Always on screen in the UI, stampede kill --all in the terminal, one API call in CI. Workers stop by themselves if they lose the server.
Auto-abort
Runs stop when errors or latency stay too high, so a target that fell over is not hammered for the rest of the test.
Audit log
Every run, stop, kill, target, secret and token change, with who did it.