The Bot That Audited My Rate Limiter
A script sprayed junk at my scan API and got 40 requests past a 3-per-week limit in one second. Tracing why led to a race condition, four siblings of the same bug, and a brute-force limiter that had never worked at all.