What problem does it solve? Choosing the right rate limit parameters for each endpoint is error-prone: limits that are too loose invite abuse, limits that are too tight punish legitimate users, and keying by the wrong identifier (IP vs user) breaks under NAT or credential-stuffing attacks. This Skill provides concrete default presets and decision rules so every Server Action, route handler, and webhook ships with an appropriate rate limit. ## Core Features & Use Cases - Preset table per action class: Default window/max/key values for reads, writes, search, login, password reset, 2FA, LLM calls, file uploads, webhooks, and public forms. - Key strategy guidance: Rules for when to key per-user, per-IP, or both (with Math.max semantics for auth-adjacent flows like login). - Algorithm selection: When to use fixed window, sliding window, or token bucket, with Upstash Redis implementation examples and progressive lockout escalation. - Use Case: While adding a login endpoint, apply the 5 min / 5 preset keyed on both IP and email to block credential stuffing without locking out users behind a shared office NAT. ## Quick Start Ask the agent to add a rate limit to a specific Server Action or route handler and it will select the appropriate preset and key strategy.
