phy-rate-limit-audit — Missing Rate Limit Detector

Scans your API source code for 10 classes of missing rate limiting that lead to brute-force attacks, cost amplification (SMS/email bombs), DoS via expensive queries, and retry storms.

Maps to OWASP API Security Top 10 2023: API4 — Unrestricted Resource Consumption.

Quick Start

# Scan a directory
python rate_limit_audit.py ./src

# Single file
python rate_limit_audit.py src/routes/auth.js

# CI mode — exit 1 on CRITICAL or HIGH
python rate_limit_audit.py ./src --ci