Rate limiting

What it detects

Endpoints whose observed behavior provides no effective request-throttling signal.

Evidence

Repeated response status, timing, and rate-limit headers where present.

Remediation

Apply per-client limits to sensitive operations and return explicit throttling responses.

Limitations

This check is limited to the applicability and evidence delivered by dast. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.

Related reference

Analyzer Registry · Findings and release decisions · Policy and confidence

Remediation guidance: Remediation and fix verification · Baselines and suppressions