Reviews the code that limits how often a caller may act. Paste the limiter, its keys and storage, the routes it covers, and the proxy setup to trace brute-force and credential-stuffing gaps, spoofable client identity, fail-open limiters, racy counters, and expensive endpoints with no cap. Returns a verdict, a route-to-limiter map, evidence-linked findings, the smallest safe fix, and checks that block abuse while valid users still get through. Written for backend developers who run login, reset, signup, and paid-API endpoints. States missing proxy or store details instead of inventing them. A code review prompt, not a live scanner or a security certificate.