[Backend/Security] Add Rate Limiting to FastAPI Scan Endpoint

[jpdevhub]

Problem

The /api/v1/scan endpoint is publicly accessible and currently has no rate limiting. A malicious user could spam thousands of scan requests, incurring heavy compute costs and degrading service for real users.

Goal

Add per-user rate limiting to the scan endpoint using slowapi (a FastAPI-compatible rate limiter based on limits).

Acceptance Criteria

• slowapi added to backend/requirements.txt
• Rate limit applied to POST /api/v1/scan: 10 requests per minute per authenticated user (keyed by user_id from JWT)
• Rate limit applied to unauthenticated demo scans: 3 requests per minute per IP
• On limit exceeded, API returns a clean JSON 429 Too Many Requests response:

  { "error": "error.rateLimitExceeded", "retry_after": 60 }

• Frontend api.ts handles 429 gracefully — shows a toast: 'Scan limit reached. Please wait a moment.'
• Unit test: backend/tests/test_rate_limit.py

Implementation Reference

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_user_id_or_ip)

@router.post('/scan')
@limiter.limit('10/minute')
async def scan(...):
    ...

[StackFox]

Hey @jpdevhub I would like to work on this issue under SSoC26 to implement the rate limiting.

Please assign me this issue.
Thanks.

[arcgod-design]

Hi @jpdevhub! I'd love to work on this as part of SSoC 2026. I'm @arcgod-design.

My Approach:

• Add slowapi to backend/requirements.txt
• Integrate slowapi limiter with the FastAPI app
• Apply rate limit of 10 requests/minute per authenticated user (keyed by user_id from JWT) to POST /api/v1/scan
• Apply rate limit of 3 requests/minute per IP for unauthenticated demo scans
• Return a proper 429 JSON response {"error": "rate_limit_exceeded", "retry_after": <seconds>} on limit breach
• Add tests to verify rate limiting behavior

Could you please assign this issue to me? Ready to start immediately!

[jpdevhub]

@StackFox go ahead

[StackFox]

@StackFox go ahead

Hey @jpdevhub can you please assign me this issue so I could start working on it?

Thanks