Glossary
Rate limit
The rule that slows down whoever is asking too often.
What it means
A rate limit caps how many times a given caller can hit an endpoint in a period. It is the difference between a script being annoying and a script being expensive.
The endpoints that need it most are the ones people forget: sign up, password reset, contact forms, search, and anything that calls a paid service. Without a limit, one script can fill your database with junk accounts, send thousands of emails from your domain and ruin its reputation, or run your model bill into real money overnight.
Limits belong on the server, keyed on something the caller cannot change freely. A check from outside deliberately does not test this, because testing it means attacking you. It stays Not verified, and the way to check is to try it yourself.
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026