Rate-limit your owned API at the edge and in the app, not only in memory

Sandbox traffic is polite. Production traffic is not. Once an owned API leaves the laptop and sits behind a real hostname, the first failure mode is not a clever bug in business logic. It is unbounded