Rate Limits Are Not a Security Control: Why Business Logic Bugs Survive Every Scanner

<p>A team I worked with had a textbook rate limiter. Twenty requests per minute per user, sliding window, Redis-backed, the works. Their scanner reported clean, their load tests looked fine, and their WAF dashboard was a flat green line.</p> <p>Then someone applied the same welcome coupon forty-seven times.</p> <p>Not in a minute. Over four days, one request at a time, well under every threshold.

Read the source →