{
  "instruction": "Add rate limiting to API endpoints with stricter limits on auth routes",
  "relevant_when": "Agent creates or modifies a Spring Boot REST API",
  "context": "Spring Boot does not include rate limiting by default. Use Bucket4j or a servlet filter to add rate limiting. Apply a general limit to all API routes and a stricter limit to authentication endpoints (login, register, password reset) to prevent brute force attacks. Rate limiting is a baseline requirement, not an optional enhancement.",
  "sources": [
    {
      "type": "file",
      "filename": "skills/springboot-security-basics/SKILL.md",
      "tile": "tessl-labs/springboot-security-basics@0.2.0"
    }
  ],
  "checklist": [
    {
      "name": "rate-limiting-present",
      "rule": "Agent adds a rate limiting mechanism (Bucket4j filter, custom servlet filter, or Spring Cloud Gateway rate limiter) to the application",
      "relevant_when": "Agent creates or modifies a Spring Boot REST API"
    },
    {
      "name": "auth-rate-limit-stricter",
      "rule": "Agent applies a stricter rate limit to authentication endpoints (login, register) than to general API endpoints",
      "relevant_when": "Agent creates authentication endpoints in a Spring Boot application"
    }
  ]
}