Act as a senior backend engineer. Add rate limiting to my {{tech_stack}} app. The endpoints I worry about most: {{page_or_feature}}. Before changing anything, list every public endpoint, server function and form handler, and tell me which have limits today. Starting limits, to adjust to our traffic: - Sign-in: 5 failed attempts per account per 15 minutes and 20 per IP, with growing delays rather than a permanent lockout attackers could use to lock real people out - Sign-up, password reset and magic links: 3 per email per hour and 10 per IP per hour - Contact and quote forms: 5 per IP per hour - AI, email-sending and other paid endpoints: a per-user daily cap plus a global spending ceiling that alerts me - General API: 60 requests per minute per signed-in user, lower for anonymous visitors How: - Enforce on the server, before any expensive work. Client-side throttles are UX, not protection - Use a shared store such as Redis, Upstash, Cloudflare or a database table, not in-memory counters that reset per server instance - Sliding window or token bucket, keyed by user ID when signed in, otherwise by IP plus route - Read the client IP only from the header our host sets; never trust a forwarded-for header anyone can spoof - Return 429 with a Retry-After header and a plain message; the form says when to try again - Log limit hits without personal data, and alert on spikes Write tests that hit each limit and confirm it resets. Finish with a table: endpoint, limit, key, window and why. Then the files changed and anything you assumed.