Alerts
Pro plan and aboveSpike detection
A budget catches a total. A spike catches a shape. Something can cost ten times its usual rate for an hour and still finish the month inside budget, and that hour is usually the one worth looking at.
What counts as a spike
Lineman compares short windows against your own recent baseline rather than a fixed number. That means a spike means the same thing for a two-person team and a fifty-person one, and it keeps meaning the right thing as your team grows.
What caused it
A spike alert is not much use if it only says spending went up. Each one carries the top contributor in every dimension for the window it covers: which developer, which repository, which model and which ticket accounted for most of it.
Where a contributor cannot be identified the alert says so rather than guessing. An unattributed share is a hint that a source integration is missing, not that the spend is untraceable.
If it fires too often
Mark the ones that were not real as false positives rather than turning spike alerts off. A genuinely bursty team is a real signal about how it works, and it is worth seeing before you decide to silence it.