From 91e58cdcf3098d0ea36fb5ef84cb8ad25efd9406 Mon Sep 17 00:00:00 2001
From: Saffron <263493777+itsmiso-ai@users.noreply.github.com>
Date: Wed, 15 Jul 2026 13:34:48 +0000
Subject: [PATCH] Document in-memory rate limiter tradeoff in
 docs/accepted-risks.md

Add entry describing that rate limits use a module-level in-memory Map
with fixed-window tracking: limits reset on process restart and are not
shared across replicas, with burst traffic possible at window boundaries.
Noted as acceptable for single-node internal ops tool deployment.

Fixes #622

Signed-off-by: Saffron <263493777+itsmiso-ai@users.noreply.github.com>
---
 docs/accepted-risks.md | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 docs/accepted-risks.md

diff --git a/docs/accepted-risks.md b/docs/accepted-risks.md
new file mode 100644
index 0000000..15fafe7
--- /dev/null
+++ b/docs/accepted-risks.md
@@ -0,0 +1,9 @@
+# Accepted Risks
+
+**Last updated: 2026-07-15**
+
+## In-Memory Rate Limiting Is Per-Instance
+
+- Rate limits on mutating endpoints (`src/lib/rate-limit.ts`) use a module-level in-memory `Map` with fixed-window tracking; limits reset on process restart and are not shared across replicas.
+- The fixed-window check allows burst traffic at window boundaries (e.g., all requests allowed immediately after the window resets).
+- **Mitigation:** acceptable for the current single-node internal ops tool deployment; move to a shared store (e.g., Redis) if the app is ever scaled horizontally or requires persistent limits across restarts.