The default request limits now suit programmatic use of an API, such
as an automation fleet on another host, and still catch abusive bots:
- per minute: 300, passed within seconds by a client firing as fast
as it can;
- per hour: 30000;
- per day: 300000, passed by a crawler that keeps up 4 a second.
At the default minute limit no client reaches the hour limit: 300 a
minute is at most 18,000 an hour.
The byte limits and ban lengths are unchanged. SPEC.md, README.md and
docs/settings.md give the reasons; docs/gitea.md redoes the Actions
runner sums.
Judgement call: the docs/alerts.md ban example shows the minute limit.
Model: opus-5-5
Initial documents: what smallwebwaf is and why, the proposed feature list, the design spec with the rule file format and the open design questions, and the survey of existing tools.
Model: fable-5-1
sneak