build1 distinct publisher
Fixed-window rate limits hand an attacker 200 requests in two seconds
A dev.to walkthrough shows the boundary bypass on a 100-per-minute cap. The weighted fix cuts the burst to 102, and charges an innocent front-loaded client 98 requests it has already spent.
Publishers:dev.to
Reality
- Evidence44
- Adoption
- Insufficient
- Hype gap+46
- Incentives34
- Confidence47