Problem
RATE_LIMIT_MAX=abc parses to NaN, and the limiter returns remaining: null without ever blocking: rate limiting silently disabled by a typo.
Where
lib/ratelimit.ts (Number(process.env.RATE_LIMIT_MAX || 20), no finite check).
Acceptance
Add a failing test first with RATE_LIMIT_MAX=abc, expecting fallback to defaults instead of allow-forever. Then fix.
Problem
RATE_LIMIT_MAX=abcparses toNaN, and the limiter returnsremaining: nullwithout ever blocking: rate limiting silently disabled by a typo.Where
lib/ratelimit.ts(Number(process.env.RATE_LIMIT_MAX || 20), no finite check).Acceptance
Add a failing test first with
RATE_LIMIT_MAX=abc, expecting fallback to defaults instead of allow-forever. Then fix.