Rate Limiting Wasn't Enough — So I Built an API Gateway with Behavioral Abuse Detection

Real rate limiting, Bloom filters, credential stuffing detection, and the bugs that almost broke...