RateLimiting
Controlling how much traffic a client/user/IP can send in a given window — protects against abuse, runaway costs (especially BYOK AI calls), and accidental self-DoS from a buggy client.
Why we need this / what value this brings
Without it, a single abusive client (or a buggy retry loop) can degrade service for everyone else, or in BYOK's case, run up costs against the user's own key without any circuit breaker.
When to use this
Any public-facing endpoint, and especially anything with a real per-call cost (the AI chat) or abuse potential (login, search).
How to use or implement this
Start with a simple algorithm (token bucket or fixed window) at the API gateway/middleware level before building anything custom per-endpoint.
Subtopics
Research questions
- Where does Localz need rate limiting today: login attempts, the AI chat endpoint (cost control), the public search API (abuse prevention)?
Empty folder — drop notes, links, and findings here as you research.