Sep 25, 2026Sep 25, 2026 · 8 min readRate Limiting Alone Won't Stop a Patient Attacker@nestjs/throttler counts requests per IP. It has no idea what an account is. Here's what that gap actually looks like, and the Redis-backed lockout that closes it.8 min read
