API Endpoint Without Rate Limiting
Servers with no rate limiting anywhere. One client can send unlimited requests: enough to brute-force a login, exhaust an API quota, or run up your bill.
What this rule detects
VC008 checks server entry files (server, app, index or main, plus middleware files) that set up Express, Hono, Fastify, Koa, Next or a raw HTTP server, and flags the file when it contains no rate-limiting code at all (express-rate-limit, @upstash/ratelimit, @elysiajs/rate-limit, a Hono limiter, or a rate-limit/throttle helper). It works per file, not per endpoint. Unthrottled login, signup and reset endpoints are VC047 and VC130, on paid plans.
Vulnerable vs. safe code
// src/server.ts
import express from "express";
import { apiRouter } from "./routes/api";
const app = express();
app.use(express.json());
app.use("/api", apiRouter);
app.listen(3000);// src/server.ts
import express from "express";
import { rateLimit } from "express-rate-limit";
import { apiRouter } from "./routes/api";
const app = express();
app.use(express.json());
// 100 requests per IP per 15 minutes across the API.
app.use("/api", rateLimit({ windowMs: 15 * 60 * 1000, limit: 100 }));
app.use("/api", apiRouter);
app.listen(3000);About A04:2021 — Insecure Design
Insecure design captures architectural problems that can't be fixed with a one-line patch — missing rate limits, business logic that allows abuse. This category is new in the 2021 list.
Impact: Missing rate limits on a login endpoint means credential stuffing works. Missing rate limits on a password reset means SMS bombing. Missing rate limits on a paid API endpoint means a $5,000 bill from one bad actor. Most of these don't look like 'security bugs' until you're in incident response.
How to fix it: Build rate limiting in from day one (per IP, per user, per endpoint). Think about the threat model: who can call this, how often, and what happens if they call it 1000x more than expected?
Common patterns in this category:
- No rate limiting on authentication endpoints
- Password reset emails sent without throttling
- API endpoints with no per-user request budget
- Business logic that can be replayed indefinitely (e.g. coupon application, vote casting)
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
Scan your code for VC008
Free, no signup: paste code or upload a file, or run npx xploitscan@latest scan . The free scan runs 30 core rules; paid plans run all 223.