[E24-S02-T01] Rate limits #350

New Issue

2026-08-27T08:08:48Z

kpcto commented

2026-08-27 08:08:48 +00:00

Parent story: [E24-S02] Rate limits (#148)

Intent

Configure and document rate limits for login and abuse-prone mutation routes.

Acceptance criteria

The login route has a configured, documented rate limit.
Abuse-prone mutation routes have documented limits and configuration.

Explicitly out of scope

Threat model (E24-S01), CSP/security headers (E24-S03), and dependency response process (E24-S04).

Test plan

Automated test asserting the rate limit triggers on login and mutation routes.

Rollback note

No data change; reverting limit configuration restores prior behaviour.

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E24-S02] Rate limits (#148) ## Intent Configure and document rate limits for login and abuse-prone mutation routes. ## Acceptance criteria - The login route has a configured, documented rate limit. - Abuse-prone mutation routes have documented limits and configuration. ## Explicitly out of scope - Threat model (E24-S01), CSP/security headers (E24-S03), and dependency response process (E24-S04). ## Test plan - Automated test asserting the rate limit triggers on login and mutation routes. ## Rollback note - No data change; reverting limit configuration restores prior behaviour. ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint 7 milestone 2026-08-27 08:08:48 +00:00

kpcto added the

labels 2026-08-27 08:08:48 +00:00

Sign in to join this conversation.