Rate-Limit Absence¶

Diagnose a whole family of endpoint abuses as one defect — a callable action left uncapped whose per-invocation cost to the service far exceeds the attacker's, so no enforced per-source budget separates legitimate demand from adversarial demand driven at machine speed.

Core Idea¶

Rate-limit absence is the security failure in which a service exposes a legitimate callable action — a login, password-reset, account-creation, or API route — without enforcing any cap on how many invocations a caller can issue in a window. The action is intended; the missing invocation budget is the defect. Its engine is cost asymmetry: the attacker's per-call cost (a cheap request) sits far below the service's (an auth check, an SMS send, a model inference), and without a budget that asymmetry can be sustained indefinitely at machine speed.

Scope of Application¶

Lives on callable network-service endpoints whose per-invocation cost to the service exceeds the attacker's.

Authentication endpoints — uncapped login enabling credential stuffing and brute force.
Password-reset flows — account enumeration through differential responses and SMS-cost amplification.
APIs and public endpoints — corpus-scale scraping, inference-cost burn, database amplification.
Account creation — sybil-population construction and spam-account farms.
Search, messaging, and webhook endpoints — complex-query DoS, harassment automation, re-trigger floods.

Clarity¶

Naming rate-limit absence separates two frames teams conflate: capacity engineering asks whether the service absorbs peak legitimate demand, while rate-limit absence asks whether a budget separates legitimate from adversarial demand at all — and the fixes are non-interchangeable, since scaling only hands the attacker headroom. It reframes which endpoints are dangerous around cost asymmetry, surfacing threats harmless per call and catastrophic in volume, and makes plain why layered per-IP, per-account, and per-population limits are each required.

Manages Complexity¶

The abuse landscape looks like a long list of unrelated named attacks. Rate-limit absence compresses it to one quantity — cost asymmetry across an uncapped action — so every item is the same event differing only in which downstream resource it drains. The analyst tracks two coordinates per action: the cost ratio and the budget state at each granularity, and the exploitability reads straight off the pair, with per-call volume dropping out of the assessment entirely.

Abstract Reasoning¶

The failure licenses a frame-disambiguation move that routes a flood to the capacity or budget branch before any fix, a cost-asymmetry threat-surfacing move that flags dangerous endpoints from the cost ratio rather than apparent sensitivity, a layered-defense move treating countermeasures as a family indexed by granularity, and an audit move converting "is this endpoint secure?" into a finite, checkable question per action.

Knowledge Transfer¶

Within software-systems engineering, security, and platform operations the failure transfers as mechanism, intact across auth, reset, API, creation, search, messaging, and webhook endpoints, because each is the same substrate — a callable action abusable for want of an enforced budget — and token-bucket algorithms port directly between them. Beyond software the shared pattern — absence of a per-source budget on a finite shared resource — recurs as genuine co-instances (admission control, receptor saturation, fishery quotas), but travels under the parent per-source-consumption-budget family, not "rate-limit absence," whose endpoint-and-attack machinery stays home-bound.

Relationships to Other Abstractions¶

Current abstraction Rate-Limit Absence Domain-specific

Parents (1) — more general patterns this builds on

Rate-Limit Absence presupposes Rate Limiting Prime

Rate-Limit Absence is defined by the omission of Rate Limiting's per-actor meter, time window, replenishing budget, and exhaustion response at an abusable endpoint.

Hierarchy paths (2) — routes to 1 parentless root

Rate-Limit Absence → Rate Limiting → Constraint

Show alternative path (1)

Neighborhood in Abstraction Space¶

Rate-Limit Absence sits in a sparse region of the domain-specific corpus (77^th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.

Family — Unclustered & Miscellaneous (309 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-07-12