rate-limit-strategylisted

# rate-limit-strategy Use when applying a rate limit to a Server Action, route handler, or webhook. Rate limits are mandatory at every trust boundary (per `harness:security-guidance`); this skill says HOW to choose the right window/max/key per use case. If you're tempted to skip rate limit "because it's internal" — wrong. The trust boundary is the URL. Anything reachable from a browser is rate-limited. ## The 3 parameters ```ts { window: '1 min', max: 10, key: 'user:${user.id}:contact-form' } ``` - `window` — time window (1 min, 1 hour, 24 hours) - `max` — number of requests allowed in the window - `key` — what gets counted (per user? per IP? per action?) ## Default presets Per action class, here are the void-harness defaults. Deviate with explicit justification in a code comment. | Action class | Window / Max | Key | Why | |---|---|---|---| | Standard read (data fetch, list) | 1 min / 100 | `user:${id}` | Generous; reads are cheap | | Standard write (create, update) | 1 min / 30 | `user:${id}` | Conservative; writes are expensive | | Search / filter | 1 min / 60 | `user:${id}` OR `ip:${ip}` | Mid | | Auth: login | 5 min / 5 | `ip:${ip}` + `email:${email}` (BOTH) | Credential stuffing | | Auth: password reset | 1 hour / 3 | `ip:${ip}` + `email:${email}` | Account enumeration | | Auth: 2FA verify | 5 min / 5 | `user:${id}` | Brute force | | Auth: 2FA resend | 5 min / 1 | `user:${id}` | SMS cost | | LLM call | 1 hour / 50 | `user:${id}` | Cost control | | File upload |