No Rate Limiting on Your API? The Honey Stall Queue

2026-10-30

The queue at the honey stall is eleven people long, and you are number nine.

It is Saturday, 9:20. Your tote bag is empty, your phone is in your hand, and you are not looking at honey. You are looking at the notes app where you keep your launch list. Every line is crossed out except one you typed at 2 a.m. on Thursday: rate limiting?

The question mark is the problem.

You built the API for a small client, a physiotherapy practice that wants online booking. It works. Login works. Bookings work. The client has already told three patients that the new system starts on Monday.

But nothing stops one script from hitting the login route ten thousand times. Nothing stops anyone from hammering the booking endpoint until the server gives up. You know this the way you know a tap is dripping. You hear it all the time now.

The thought that follows you round the market

You buy a jar of honey you don't need. You walk past the cheese stall, the bread stall, the man selling dahlias in buckets, and the whole way your head runs the same loop.

Am I in trouble? Is this the kind of thing that ends a launch? Or the kind of thing everyone ships without and fixes in week two?

You don't know. That is what makes it heavy. Not knowing the answer, and not knowing who to ask without admitting you didn't think of it sooner.

You are a freelancer, so there is no security team down the corridor. No colleague to lean over and say, "Oh, that one's fine, just put it on the list." There is you, a laptop, and a client who trusts you because you sounded sure in the first meeting.

So the worry comes in quietly and sits next to the other ones:

• What if there are three more things like this and you only noticed one?
• What if you spend the whole weekend patching, and Monday still feels shaky?
• What if the first thing the client ever sees from your work is an error page?

None of it is dramatic. It is just a low, steady hum, and it costs you the weekend. You nod at your partner's story about the neighbour's fence and hear none of it.

What you are actually afraid of

It is rarely the one missing item. It is not having the whole picture.

A missing rate limit is a fixable thing. You could probably add something sensible in an afternoon. What keeps you up is the suspicion that it is only the first thing you happened to notice. Without a list, every gap feels like a sign of ten more.

And you can't tell the difference between this is a normal gap, everyone has them and this is the one that matters, because you have never looked at the whole thing in order, from start to finish, with someone else's checklist in hand.

So you do what tired people do. You look at it in fragments, at odd hours, between other tasks, and you never get the feeling of done.

The turn, somewhere near the bread stall

You stop beside a table of sourdough, and a plain thought arrives.

You don't need to feel certain about everything. You need to know what everything is.

A finite list changes the shape of a worry. Fifty-odd things you can see are a smaller problem than an unnamed fog. Some will be fine already. Some will be a ten-minute fix. A few will be "not before Monday, but written down, with a date." And a written-down gap is a decision you made, not a surprise waiting for you.

That is the difference between launching nervously and launching with your eyes open.

You also realise something kinder. Having no rate limiting doesn't mean you are careless. It means you are one person who built a whole system alone, and nobody handed you the list.

A different Monday

Picture it.

It is Monday, 8:40, and your coffee is still warm. The client messages: Ready when you are. You open the tracker. Most rows are green. Two are amber, with a note in your own words: add after launch, due Thursday. One was red on Saturday and isn't any more.

No part of you is guessing.

When the practice owner asks, a little nervously, "Is it all safe?", you don't say "I think so." You say what you checked, what you left for later, and why. You sound like someone who runs a real business, because you do.

The launch happens. A patient books a Tuesday appointment. The server hums along. You go and make lunch.

Nothing in that picture is heroic. It is just calm, and calm is what you were really shopping for this whole time.

Back to the honey

Walking home, the jar knocking against your hip, you decide the weekend is not for panic. It is for one slow, orderly pass through everything, rate limiting included, so that on Monday you know where you stand.

If that sounds like what you need, there is a kit made for exactly this moment. Launch Without the 2 a.m. Doubt – REST API Security Checklist Kit is a 58-item API review kit: a PDF and an XLSX tracker, curl tests, an auth-route scanner script and a client report template, for Node/Express and Python. It was made with AI, checked automatically and refined by real use. It is a way to organise your review, not a guarantee and not a replacement for a professional audit when the stakes call for one. It comes with a 30-day money-back promise: if it doesn't help, you get a full refund, no questions.

If you recognise yourself in the queue at the honey stall, you can have a look here: REST API Security Checklist Kit

Either way, put the phone away for a minute. Smell the bread. You are allowed to launch on Monday.

An illustrative story, written with AI assistance.