amadan
console: hitting maxRateKeys (8192 distinct keys/day) drops every rate-limit budget in the process Issue open
Migrated from github.com/carlosframework/platform issue #316, opened 2026-08-27. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: Hitting 8192 distinct rate-limit keys drops every caller's budget at once instead of evicting the oldest.
---
Surfaced by the open-source redaction audit (2026-08-27). \internal/console/authcli.go\ (~L113-118) records that once the limiter map exceeds \maxRateKeys\ it is dropped wholesale, resetting every caller's budget — "recorded, not defended". An attacker who can generate 8k distinct keys (create attempts from many addresses) resets the guess/ship/create budgets for everyone, including their own.
Fix shape: evict oldest/least-recently-touched keys instead of dropping the map, or cap by per-IP key count so one source cannot fill it.