# Missing API Rate Limiting

> Detects sensitive API endpoints without rate limiting, enabling resource exhaustion, credential stuffing, and enumeration attacks.

- Skill: `zakirkun/missing-api-rate-limiting` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/missing-api-rate-limiting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/missing-api-rate-limiting/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/missing-api-rate-limiting

---


# Missing API Rate Limiting

## Overview
APIs without rate limiting are vulnerable to:
- **Credential stuffing**: Automated login attempts with breached credentials
- **Resource exhaustion**: Expensive computation triggered repeatedly (DoS)
- **Data harvesting**: Scraping all records via automated enumeration
- **OTP brute force**: Guessing 6-digit codes in 1,000,000 requests

## Detection Strategy
Identify API endpoints handling authentication, password reset, OTP verification, or resource-intensive operations that lack rate limiting middleware.

## Remediation
Apply rate limiting at the API gateway or application level with per-IP or per-user quotas.