Three profiles that exploit the same missing control.
🤖
The Automated Scraper
Writes a script to call the API in a loop — pulling users, products, prices, or content. No authentication required in the worst cases. With no rate limit, the script runs overnight and extracts the entire dataset before morning. The Venmo researcher is a perfect example: public endpoint + no rate limit = 207M records in 30 days.
💰
The Cost Bomber
Identifies an API endpoint that triggers expensive third-party operations — AI inference, SMS OTPs, email sends. Writes a script to call it thousands of times, running up the API owner's cloud or provider bill. This is sometimes used for targeted financial harassment of competitors, or by researchers demonstrating a vulnerability.
🧑💻
The Naively Heavy User
Not malicious — just a developer using your API who wrote an inefficient client. They loop through 50,000 records one-by-one instead of using batch endpoints. Their good-faith usage takes down your service for everyone else. Without rate limits, there's no guardrail protecting your infrastructure even from well-intentioned overuse.
The attacker advantage
All three profiles look identical in the logs: a valid token (or no token), valid requests, valid responses. Without rate limiting, you have no basis to distinguish a scraper from a power user until the damage is done.