Enrollment rate-limit bucket scope unresolved: per-source or plane-wide?

open   by a73x

Labels: backlog

From the pre-launch security audit (finding API-7). Ranked #1 of the OUTSTANDING set —
not because it is confirmed High, but because it is the cheapest unresolved uncertainty.

**The uncertainty.** The enrollment limiter demonstrably works (5x403 -> 429 observed
black-box). But from a single source address I could not tell whether I emptied *my*
bucket or *the plane's*. If the bucket is plane-wide, ~6 requests from anywhere pause
fleet enrollment for everyone — an unauthenticated, fleet-wide DoS. If it is per-source,
this is Low and closes.

**Part A (10 minutes).** Resolve the bucket scope — read the limiter/proxy config, or
probe from two source addresses. This either drops the finding or escalates it to the
top of the whole list.

**Part B (if needed).** A Traefik `rateLimit` middleware on the console/API IngressRoutes
with an explicit `sourceCriterion` makes the scope per-source by construction, and needs
no Cloudflare account or DNS change (the plane already fronts HTTP with Traefik). Draft
was scoped but not built.