Capture bounded SAML envelopes and document proxy limits

README.md

@@ -84,6 +84,31 @@ configurable evidence quota, a 16MiB request-body limit and eight concurrent req
 may reject or normalize traffic before it reaches the collector; unread/rejected bytes beyond
 these boundaries cannot be promised as captured.
 
+### Cloudflare / NPM coverage limits
+
+Cloudflare and NPM can remain in front of this collector. Apply WAF/cache exceptions only
+to dedicated honeypot hostnames, and preserve trusted client attribution at each hop.
+The public IP, certificate, TLS handshake and HTTP/2 or HTTP/3 behavior belong to the edge,
+so IP-only or TLS-specific scanners may not identify the simulated NetScaler behind it.
+Cloudflare can strip/rewrite headers and reject malformed or DDoS traffic before origin;
+NPM changes transport framing too. Recorded wire bytes are what the collector consumed,
+not an exact copy of the original internet connection. Correlate Cloudflare security-event
+Ray IDs with CF-Ray in captured requests and inspect the dedicated NPM access/error logs
+for rejected requests. Those edge logs do not recover rejected request bodies.
+
+DTLS is inactive and not implemented by this HTTP listener. Ordinary Cloudflare HTTP
+proxying does not carry UDP/DTLS; adding it later requires an appropriate Spectrum
+entitlement and a separate isolated UDP capture/simulation path. No UDP listener or real
+NetScaler firmware is enabled by this project. See [Cloudflare proxy limits](https://developers.cloudflare.com/dns/proxy-status/limitations/).
+
+SAMLRequest/SAMLResponse form and query fields are additionally base64-decoded into inert
+`saml_payload` artifacts. Redirect-binding DEFLATE output is capped at64KiB; original
+request bytes and the decoded compressed envelope remain retained if inflation fails.
+Form/query decoding is limited to64KiB and128 fields. XML is never parsed, entities are
+never expanded, signatures are never accepted, and no SAML authentication is performed.
+These are evidence aids, not proof of a SAML CVE attempt. Oversized accepted requests
+remain in raw capture even when optional decoding is skipped.
+
 Checks: `python3 test_nitro.py`, `python3 test_capture.py`, `python3 test_honeypot.py` and
 `python3 test_safety.py`. Optional execution tools described below are incompatible with
 `--simulation-only` and are not used by the supplied HTTP service.