Rate limiting for small teams

Every audit we run turns up some version of this. Most advice about rate limiting assumes a team that does not exist at your size. Here is the version that does not.

The cheapest security work is the boring kind done on a schedule. Budget a little time for it every quarter and it never becomes a project of its own.

What to keep

Unlimited endpoints get abused eventually. The cost of getting this wrong is rarely visible on the day it happens. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

What to drop

Process that exists to coordinate ten people is overhead when there are two of you. In practice this is a scheduling problem more than a technical one.

How we handle it

Return a clear response instead of failing silently. The teams that handle this well are rarely the ones with the biggest budgets. Budget a little time for it every quarter and it never becomes a project of its own.

The short version

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about rate limiting before you move on:

• Someone can say what the current setup is without going to look
• Unlimited endpoints get abused eventually — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.