Rate Limiting

Add per-user rate limiting to prevent abuse from compromised accounts, bots, or malicious actors. Addresses OWASP A04 (Insecure Design) and A07 (Authentication Failures).

Why Rate Limiting Matters

Without rate limiting:

• A stolen session token can drain all credits in seconds
• A bot can create thousands of payment invoices
• A single user can DoS your service
• Brute-force attacks against auth endpoints succeed

Cloudflare Workers (KV-based Sliding Window)

Rate Limit Utility

// lib/rate-limit.ts
import { auditLog } from './audit';