Prompt: add rate limiting to your app
Without limits, your login is a password-guessing endpoint and your AI feature is someone else's free tier.
Nothing in an AI-generated app stops the same request arriving ten thousand times. That matters most on login (password guessing), signup (fake accounts) and anything that calls a paid provider (your bill).
Copy this into Cursor, Claude Code, Lovable or your builder
Add rate limiting to this application. 1. List every endpoint that should be limited, ranked by risk: - authentication: login, signup, password reset, magic link - anything calling a paid third-party API (AI providers, email, SMS) - anything that writes to the database on unauthenticated input 2. Implement limits at the edge where possible, and in the application otherwise. Key on IP for anonymous traffic and on user id for signed-in traffic — IP alone is unfair behind shared networks and useless against distributed abuse. 3. Return HTTP 429 with a Retry-After header, not a generic 500. 4. Use stricter limits on authentication: a handful of attempts per account per fifteen minutes, with escalating delay. 5. Make sure the limiter state is shared across instances — an in-memory counter resets on deploy and does not work with more than one server. Tell me the limit chosen for each endpoint and where the state is stored.
What your AI should do with it
- Different limits per endpoint rather than one global number.
- Keying on user id where available, not IP alone.
- Shared state, so limits survive a restart and multiple instances.
How to check it worked
Send a burst at your own login endpoint
for i in $(seq 1 15); do
curl -s -o /dev/null -w "%{http_code} " \
-X POST https://YOURAPP.com/api/login \
-H 'content-type: application/json' \
-d '{"email":"[email protected]","password":"wrong"}'
done; echoThis is one check out of 40+
Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.
Check my site — free