pook/compliancebot

Fork 0

Add rate limiting on POST /api/generate to prevent AI cost runaway #99

New issue

Closed

opened 2026-04-08 18:33:21 -04:00 by pook · 1 comment

pook commented

2026-04-08 18:33:21 -04:00

Owner

Without rate limiting, a single user or attacker can trigger unlimited AI generation calls, causing unbounded API costs. This is a revenue-protection critical fix.

Add express-rate-limit (or similar) middleware on POST /api/generate
Default: 10 requests per minute per IP, configurable via RATE_LIMIT_GENERATE_RPM env var
Return 429 with Retry-After header when limit is exceeded
Log rate-limited requests with IP and user context for abuse monitoring

Acceptance criteria:

11th request within 60s from same IP returns 429
Retry-After header is present and correct on 429 responses
Rate limit is configurable via environment variable
Integration test verifies rate limiting triggers correctly

Generated by CEO Planner (priority: 2)

Without rate limiting, a single user or attacker can trigger unlimited AI generation calls, causing unbounded API costs. This is a revenue-protection critical fix. 1. Add express-rate-limit (or similar) middleware on POST /api/generate 2. Default: 10 requests per minute per IP, configurable via RATE_LIMIT_GENERATE_RPM env var 3. Return 429 with Retry-After header when limit is exceeded 4. Log rate-limited requests with IP and user context for abuse monitoring Acceptance criteria: - 11th request within 60s from same IP returns 429 - Retry-After header is present and correct on 429 responses - Rate limit is configurable via environment variable - Integration test verifies rate limiting triggers correctly --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-08 18:33:21 -04:00

pook referenced this issue

2026-04-08 23:31:16 -04:00

Add express-rate-limit to POST /api/generate with 5 req/min per IP to prevent AI cost runaway #170

pook referenced this issue

2026-04-08 23:34:57 -04:00

[Agent] Issue #170: issue 99 rate limiting on apigenerate ex #172

pook referenced this issue

2026-04-09 06:08:04 -04:00

Close 10 stale tasks that have matching PRs or duplicate scope #251

pook referenced this issue

2026-04-09 06:12:21 -04:00

Add express-rate-limit to POST /api/generate with 5 req/min per IP to prevent AI cost runaway #170

pook referenced this issue

2026-04-09 06:12:29 -04:00

[Agent] Issue #251: 10 issues are stale but many have duplic #253

pook commented

2026-04-10 14:48:29 -04:00

Author

Owner

Bulk-closed 2026-04-10 during pipeline triage.

Context: CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch agent/dispatch/* because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key.

What to do next:

Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge
CEO should halt new task creation until open PRs drop below 10
Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks)

This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

Bulk-closed 2026-04-10 during pipeline triage. **Context:** CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch `agent/dispatch/*` because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key. **What to do next:** 1. Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge 2. CEO should halt new task creation until open PRs drop below 10 3. Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks) This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

pook closed this issue

2026-04-10 14:48:29 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#99

No description provided.

Rows
Columns