The authoritative source for the definition, vulnerable patterns, example attack scenarios, and prevention guidance in this module. The three attack scenarios on slides 14–16 are drawn directly from the OWASP API4 page (unbounded pagination, AI cost amplification, SMS OTP flooding). CWE references: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption). This course is an independent study companion — not affiliated with or endorsed by OWASP.

Researcher Dan Salmon scraped 207,984,218 public Venmo transactions over approximately one month using Venmo's public transaction API. The endpoint required no authentication and had no rate limiting. Salmon published aggregate findings on his blog to demonstrate the privacy implications of combining public transaction data (which included real names, amounts, and payment messages) with unthrottled bulk access. Venmo subsequently added rate limiting to the endpoint. The incident prompted broader discussion about whether "public by default" and "accessible in bulk" are the same threat model. Referenced in slides 1, 11, 26.

Twitter's "find your contacts" feature included an API endpoint that accepted phone numbers or email addresses and returned associated Twitter accounts. The endpoint had a logic vulnerability (it returned data for phone numbers not belonging to the requesting user) combined with insufficient rate limiting. Attackers automated lookups against phone number ranges, collecting 5.4 million account-to-phone-number mappings. The dataset was posted for sale in July 2022 and made freely available online. Twitter disclosed the breach in August 2022. The original vulnerability report was submitted via their bug bounty program in January 2022 — six months before the breach disclosure. Referenced in slides 13, 26.

Implementation guidance on rate limiting strategies for REST APIs, including token bucket vs. sliding window algorithms, per-IP vs. per-user vs. per-resource limiting, and HTTP response conventions (429 Too Many Requests, Retry-After header). Directly informs MIT 01 in this module.

Technical background on GraphQL's N+1 query problem and how deeply nested queries can generate exponential database calls from a single HTTP request. Covers depth limiting (reject queries beyond N levels) and complexity scoring (assign costs to fields, reject when total exceeds threshold). Referenced in MIT 05 on slide 23.

AWS guidance on setting billing alerts, budget caps, and per-resource spending thresholds. Context for the "billing alerts are a fallback, not a defense" argument in MIT 06 — alerts report after spending occurs; API-layer rate limits prevent spending from occurring.

Interactive labs for testing API vulnerabilities including rate limit bypass techniques and resource consumption patterns. Recommended hands-on practice after completing this module.

Salmon's original write-up of the Venmo scraping experiment, including methodology, what was found in the data, and his recommendations for Venmo. A clear first-person account of how a public API with no rate limiting exposes the entire dataset to anyone willing to write a loop. Search for "Dan Salmon Venmo scraping" to find archived copies.