Rate limiting detection too weak (10 requests) #4
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Current rate limiting test in
vectors/14-api-abuse.shsends only 10 rapid requests. Most real API rate limiters require 30-100+ requests over a longer window to trigger.Fix: Increase to 50 requests with a 200ms spread, and also test different endpoints separately.