What problem does it solve? Security testers need a disciplined, low-noise way to determine whether login, OTP, password recovery, invite code, search, and API endpoints enforce server-side rate limits, lockouts, idempotency, and CAPTCHA boundaries without performing credential stuffing, spraying, or brute-force attacks. ## Core Features & Use Cases - Evidence-Gated Measurement Plan: Defines a baseline → single-variable probe → post-baseline → oracle → evidence workflow using only self-owned accounts, approved request rates, and a minimal input set. - Control Differentiation: Distinguishes explicit 429 responses, silent/shadow throttling, account lockout, IP/device-level limits, and success-versus-failure counters, recording status, latency, headers, and account state per request. - Strict Oracle and Stop Conditions: Treats WAF blocks, CAPTCHAs, timeouts, and single anomalies as INCONCLUSIVE, and halts on lockout, scope violations, or shared-service impact, routing findings to password-recovery, MFA, or business-logic specialists. - Use Case: During an authorized web assessment, verify whether the OTP verification endpoint locks out or throttles after a small number of failed attempts from your own test account, then document exact counts, time windows, and recovery behavior as evidence. ## Quick Start Ask the agent to run the hunt-rate-limit route against the in-scope login endpoint using your own test account and confirm whether server-side rate limiting or lockout triggers within the approved request budget.
