preference-cooldown-bypass-bug

Bypassing rate limiting happens when the updatedAt timestamp for a preference also drives the cooldown timer, so toggling the preference refreshes the timestamp and resets the cooldown. Separating the cooldown state into a dedicated key prevents this bypass.

To separate cooldown tracking in TypeScript, introduce a dedicated cooldown key in your data model, store timestamps in ISO format, and update your queries to check this key independently of the boolean preference flag. This ensures cooldown persistence across preference toggles.

You need to separate cooldown state from user preferences whenever a boolean preference gates a feature while the same timestamp drives a cooldown timer. This pattern applies to scenarios like messaging systems that must throttle notifications even if users toggle their preferences.

The best way to prevent rate-limiting bypass is enforcing a data-model separation with dedicated cooldown keys and ISO timestamp storage. This approach maintains cooldown integrity by ensuring the preference toggle state cannot overwrite the cooldown tracking timestamp.

Yes, you need to migrate existing data by introducing a dedicated cooldown key and transferring the current timestamp values. The Skill provides migration guidance and concrete code patterns for updating queries and data models to maintain cooldown integrity.

To test that a preference toggle does not reset the cooldown timer, run tests that confirm cooldown persistence across preference toggles. Verify that toggling the boolean flag leaves the dedicated cooldown key and its ISO timestamp unchanged.