diff --git a/pkg/accessreview/drivers/name_resolver.go b/pkg/accessreview/drivers/name_resolver.go
index cfa66dfb5..3f3b9a4ac 100644
--- a/pkg/accessreview/drivers/name_resolver.go
+++ b/pkg/accessreview/drivers/name_resolver.go
@@ -206,6 +206,9 @@ func (r *cloudflareNameResolver) ResolveInstanceName(ctx context.Context) (strin
 
 	q := cfURL.Query()
 	q.Set("page", "1")
+	// Cloudflare requires per_page in the range 5..50; per_page=1 is rejected
+	// with a 400 (which, before terminal classification, caused a 400 storm).
+	// Do not "optimize" this back down to 1.
 	q.Set("per_page", "50")
 	cfURL.RawQuery = q.Encode()
 
diff --git a/pkg/connector/vercel.go b/pkg/connector/vercel.go
index b2cb304af..ba9d6c2df 100644
--- a/pkg/connector/vercel.go
+++ b/pkg/connector/vercel.go
@@ -77,7 +77,7 @@ func FetchVercelUser(ctx context.Context, client *http.Client) (VercelUser, erro
 // one-shot SSRF-protected client and applies the freshly-minted access
 // token as a Bearer header on the request. The OAuth callback handler
 // uses the returned UID as a synthetic TeamID when the install targets
-// a personal account (no team_id surfaced by the callback).
+// a personal account (no teamId surfaced by the callback).
 func FetchVercelUserID(ctx context.Context, accessToken string) (string, error) {
 	reqCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()