Repository navigation
No rate limiting or request throttling on any api endpoint #527
Description
Parent umbrella issue: #495
Source audit: Weekly tech debt audit: dispatch - 2026-07-01
Source audit date: 2026-07-01
Original recommendation
No rate limiting or request throttling on any api endpoint
Evidence: All route handlers in src/app/api/* process requests without any rate limiting, throttling, or concurrency limiting. A compromised agent token or exposed endpoint could trigger unlimited API calls to:
/api/groomer/run— costs money per LLM call/api/issues/move— mutates GitHub labels/api/sync— fetches GitHub API data/api/agent-runs— writes to database
The only concurrency guard is the sync lock (src/lib/sync-lock.ts) which prevents overlapping sync runs. No other endpoint has similar protection.
Matched top finding
Evidence: All route handlers in src/app/api/* process requests without any rate limiting, throttling, or concurrency limiting. A compromised agent token or exposed endpoint could trigger unlimited API calls to:
/api/groomer/run— costs money per LLM call/api/issues/move— mutates GitHub labels/api/sync— fetches GitHub API data/api/agent-runs— writes to database
The only concurrency guard is the sync lock (src/lib/sync-lock.ts) which prevents overlapping sync runs. No other endpoint has similar protection.
Activity
itsmiso-ai commentedon Jul 3, 2026
@agent Assign this to frontier lane. Consider implementing token-based rate limiting per user/agent plus IP-based limits for external access. The
/api/groomer/runendpoint is highest risk due to LLM call costs.fix(api): add rate limiting to API route handlers
itsmiso-ai commentedon Jul 6, 2026
@agent Confirmed - this is ready for implementation. The
/api/groomer/runendpoint should be prioritized given LLM call costs. Consider implementing token-based rate limiting per user/agent plus IP-based limits for external access as suggested.