diff --git a/VERSION b/VERSION
index aea1186..7000921 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.2.82
+1.2.83
diff --git a/cmd/edgeguard-waf/main.go b/cmd/edgeguard-waf/main.go
index f3b291f..d917a86 100644
--- a/cmd/edgeguard-waf/main.go
+++ b/cmd/edgeguard-waf/main.go
@@ -70,7 +70,7 @@ func main() {
 		}
 	}()
 
-	alertWriter := intwaf.NewAlertWriter(pool, 512)
+	alertWriter := intwaf.NewAlertWriter(pool, 2048)
 
 	agent := intwaf.SPOEAgent{
 		Manager:     mgr,
diff --git a/internal/waf/spoe.go b/internal/waf/spoe.go
index 0f696c3..3b7652b 100644
--- a/internal/waf/spoe.go
+++ b/internal/waf/spoe.go
@@ -138,9 +138,15 @@ func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.Match
 	if a.AlertWriter == nil {
 		return
 	}
-	// Skip rules with no message — these are CRS skip/control-flow rules
-	// (e.g. 949011..949018, 911011..911018) that match but carry no alert info.
-	if mr.Message() == "" && mr.Rule().ID() > 0 {
+	ruleID := mr.Rule().ID()
+	// Skip CRS setup/initialization rules (900xxx–909xxx) — they fire on
+	// every request as part of CRS init and are not security events.
+	// Real detection rules start at 910xxx (IP reputation) and above.
+	if ruleID > 0 && ruleID < 910000 {
+		return
+	}
+	// Skip control-flow rules with no message (PL-skip markers).
+	if mr.Message() == "" {
 		return
 	}
 	action := "detected"