What is rate limiting?
Rate limiting is a cap on how many requests one person, device or key can make to your app in a set amount of time. Past the cap, further requests are refused for a while. It stops people guessing passwords, scraping your data and running up your bills.
ON THIS PAGE
What it means
Without a cap, anyone can call your app as fast as their computer allows. A script can try thousands of passwords a minute or hit a paid AI endpoint until your credit card is empty.
A rate limit is a simple counter: for example, 10 login attempts per 15 minutes per address. When the counter runs out, your app answers with a polite 'too many requests' message.
Why it matters for vibe-coded apps
AI tools build the working path and rarely think about abuse. Endpoints that cost you money or guard accounts are usually left wide open.
- Attackers can guess passwords or one-time codes without being slowed down.
- A single bot can run up your OpenAI, email or SMS bill overnight.
- Heavy traffic from one source can slow or take down your app for everyone.
Example
A login route that accepts unlimited attempts.
app.post("/login", login);import rateLimit from "express-rate-limit";
app.post("/login", rateLimit({ windowMs: 15 * 60 * 1000, limit: 10 }), login);Use stricter limits for login, password reset and anything that costs money, and looser ones for everything else.
How to check if your app has this problem
- 1List the routes that log people in, send emails or texts, or call a paid service.
- 2Send the same request 50 times quickly. If it never says "too many requests", it has no limit.
- 3Check your hosting dashboard for built-in limits you may not have switched on.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Add a rate limit to login, sign-up, password reset and every route that costs money.
- 2Count by user where possible, and by IP address where there is no login.
- 3Return a clear 429 "too many requests" message with a time to wait.
- 4Set a spending cap with paid providers as a second safety net.
Add rate limiting to my project. Use a strict limit (about 10 requests per 15 minutes per IP) on login, sign-up and password reset, and a sensible limit on every route that calls a paid service such as OpenAI, email or SMS. Return a 429 status with a Retry-After header when the limit is hit. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for rate limiting issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- API key exposureA secret key for a paid service ends up where the public can see it.
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
- Two-factor authentication (2FA)A second step at login, like a code from your phone.
- Password hashingStoring passwords scrambled, so even you can't read them.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.