# Rate limit misconfigured: pre-release checklist

Source: https://releasefailures.com/incidents/rate-limit-misconfigured/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A rate limit change blocks legitimate traffic or stops protecting an endpoint.
- [ ] PR-01 Diff the rate limit values of each public API between the release and production and block the change when any limit drops without an approved change record. (test class: Configuration and environment tests)
- [ ] PR-02 Apply the rate limit scaling flag to a partial subset of users in pre-production and confirm the global limiter still admits requests from users outside the subset. (test class: Configuration and environment tests)
- [ ] PR-03 Send one request as a client on the rate limiting allowlist through the changed proxy configuration and confirm the request bypasses the limit. (test class: Configuration and environment tests)
- [ ] PR-04 Replay a five-minute window of production traffic that includes allowlisted and Git over HTTPS clients and confirm the bypass count stays at its production level. (test class: Load and performance tests)
- [ ] PR-05 Load test session starts at peak rate against the updated internal rate limit and confirm sessions start without queuing. (test class: Load and performance tests)
- [ ] PR-06 Load test guild loading right after a session backlog clears and confirm the internal service's scaling targets keep latency within budget. (test class: Load and performance tests)
- [ ] PR-07 Add an alert for when the share of HTTP 429 responses rises above twice its 7-day baseline after any rate limit or proxy change. (test class: Canary and progressive delivery checks)
- [ ] PR-08 Halt a partial flag rollout automatically when 403 responses from the rate limiter rise above baseline. (test class: Canary and progressive delivery checks)
- [ ] PR-09 Alert when the count of requests bypassing rate limiting falls by more than 50 percent within one 5-minute window. (test class: Canary and progressive delivery checks)