infrastructure-rate-limiting-public-scan-endpoints-are-susceptible-to-tarpittin-c505f1d7

THEN Implement IP+URL pair rate limit middleware on endpoints like /sync/onboard. Allow re-onboarding the same URL without counting against the limit.

@app.middleware('http')
async def rate_limit_onboard(request, call_next):
    if request.url.path == '/api/v1/sync/onboard' and request.method == 'POST':
        ip = ...
        if not _check_rate(ip, url):
            return JSONResponse(429, {'detail': '...'})