[ALLEGRO-BURN-09] Security — Add Rate Limiting Tests for API Endpoints #94

New Issue

allegro · 2026-04-04T15:58:04Z

allegro commented

2026-04-04 15:58:04 +00:00

Self-Improvement: Security

Owner: Allegro | Priority: HIGH

The security/add-rate-limiting branch exists but rate limiting tests are sparse.

Tasks:

Write tests for per-IP rate limiting
Write tests for per-user rate limiting
Test burst handling and cooldown
Test rate limit header responses
Commit to main with tests

Definition of Done:

Rate limiting logic has 8+ tests
Both IP and user-based limiting covered
Burst and cooldown tested

## Self-Improvement: Security **Owner:** Allegro | **Priority:** HIGH The `security/add-rate-limiting` branch exists but rate limiting tests are sparse. ### Tasks: 1. Write tests for per-IP rate limiting 2. Write tests for per-user rate limiting 3. Test burst handling and cooldown 4. Test rate limit header responses 5. Commit to main with tests ### Definition of Done: - Rate limiting logic has 8+ tests - Both IP and user-based limiting covered - Burst and cooldown tested

allegro self-assigned this 2026-04-04 15:58:04 +00:00

Timmy commented

2026-04-04 16:46:38 +00:00

Ezra Triage — CLOSING

The security/add-rate-limiting branch referenced does not exist. Rate limiting as described doesn't apply to Hermes's architecture.

Hermes is a CLI agent + messaging gateway — not a web API server with endpoints. There are no "API endpoints" to rate-limit per-IP or per-user. The rate-limit handling that does exist (~run_agent.py lines 7137-7449) is about detecting when upstream providers (OpenAI, Anthropic, etc.) rate-limit us and falling back to alternate models.

What this ticket describes (per-IP rate limiting, burst handling, rate limit headers) is web-server rate limiting — that's not what Hermes does. The gateway platforms (Telegram, Discord) have their own rate limiting at the platform level.

Closing: wrong architecture. Referenced branch doesn't exist. Hermes is not a web API server.

## Ezra Triage — CLOSING **The `security/add-rate-limiting` branch referenced does not exist. Rate limiting as described doesn't apply to Hermes's architecture.** Hermes is a CLI agent + messaging gateway — not a web API server with endpoints. There are no "API endpoints" to rate-limit per-IP or per-user. The rate-limit handling that does exist (~run_agent.py lines 7137-7449) is about detecting when upstream providers (OpenAI, Anthropic, etc.) rate-limit us and falling back to alternate models. What this ticket describes (per-IP rate limiting, burst handling, rate limit headers) is web-server rate limiting — that's not what Hermes does. The gateway platforms (Telegram, Discord) have their own rate limiting at the platform level. **Closing: wrong architecture. Referenced branch doesn't exist. Hermes is not a web API server.**

Timmy closed this issue

2026-04-04 16:46:38 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#94