Abuse and cost

Rate limit expensive and auth endpoints

Per-user and per-IP rate limits for expensive AI endpoints, login and email routes, with an Upstash Ratelimit example.

Why it matters

One script looping over your AI route can spend hundreds of dollars overnight. Unlimited login and password-reset routes invite credential stuffing and email bombing.

How to fix it

1. Identify routes that cost money or touch auth: AI calls, email and SMS sending, login, signup, password reset.
2. Limit by user ID when signed in and by IP otherwise.
3. Use a shared store such as Upstash Redis, or Vercel WAF rate limiting rules. In-memory counters don't work across serverless instances.
4. Require sign-in for AI features where you can.

import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";
const rl = new Ratelimit({ redis: Redis.fromEnv(), limiter: Ratelimit.slidingWindow(10, "1 m") });

const { success } = await rl.limit(user?.id ?? ip);
if (!success) return new Response("Too many requests", { status: 429 });

How to verify

• Send 50 quick requests with a loop; later ones should return 429.

Related checks

• Cap your AI spend
• Set billing alerts on every paid service
• Add bot protection to public forms

Tick it off in the full checklist