gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-26 11:49:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: harden public docs by removing security-sensitive details (#331)

Browse Source 
* docs: remove security-sensitive implementation details from public documentation

Generalize or remove internal architecture details that could aid targeted
attacks — CVE tables, database schema, rate limit thresholds, proxy internals,
encryption algorithm names, and WebSocket middleware bypass info.

* test(metrics): fix flaky minute-bucket aggregation test

Floor baseTime to the start of the current minute so baseTime + 5000
never crosses a minute boundary and produces 2 buckets instead of 1.
This commit is contained in:
Anso
2026-04-01 23:48:49 -04:00
committed by GitHub
parent 7d9dcc77d4
commit c4e2595ded
7 changed files with 28 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api-reference/overview.mdx
+2 -6
View File
@@ -88,7 +88,7 @@ This applies to all stack endpoints: read, write, deploy, down, restart, stop, s
## Rate limiting
All `/api/` endpoints are subject to a global rate limit of **100 requests per minute** per IP address. When exceeded, the server responds with `429 Too Many Requests`:
All API endpoints are rate-limited per IP address. Authentication endpoints have stricter limits to prevent brute-force attacks. When exceeded, the server responds with `429 Too Many Requests`:
```json
{
@@ -96,11 +96,7 @@ All `/api/` endpoints are subject to a global rate limit of **100 requests per m
}
```
Authentication endpoints (`/api/auth/*`) have an additional, stricter limit of **5 requests per 15 minutes** to prevent brute-force attacks. Both limits apply independently — a login request counts against both the global limit and the auth limit.
The global rate limit is configurable via the `API_RATE_LIMIT` environment variable (requests per minute, default `100`).
Standard rate limit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) are included in all API responses.
Standard rate limit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) are included in all API responses, so clients can self-throttle accordingly.
## License tier requirements