This is what surprises me in this story. I could not, at first glance, assume that either Substack people or Cloudflare people were incompetent.

Oh: I resisted tooth and nail about turning on a WAF at one of my gigs (there was no strict requirement for it, just cargo cult). Turns out - I was right.