Limitation de débit (rate limiting)
Rate limiting is a cap on how many times one visitor can call your application in a given time window. Without it, a bot sends a flood of requests at once. If your application calls a paid language model on each request, you pay for every one. The OWASP ranking of API risks files this gap under unrestricted resource consumption, and recommends capping call frequency over a time window. It also notes that a service billed per request (SMS, phone calls, biometric checks) can run the bill up in minutes, and advises a spending cap with the provider, or failing that a billing alert. The trap specific to generated code: the app works in the demo, so nobody thinks about the day a script loops over the route that calls the model. A cap is set stricter on sensitive routes (sending a code by SMS, sign-in) than on a read-only page.