Skip to content

GET /bounties/:id and the other public read routes have no throttle beyond the global 120/min, and list routes are full-table scans #592

Closed

Description

@chonilius

Problem

GET /bounties, /milestones and /maintenance-pools are unauthenticated, return the entire table (#63), and now join relations. Each is limited only by the global default throttler (120 requests/min per IP, effectively per proxy without trust proxy). A handful of clients can keep the database busy with full scans.

Suggested fix

Paginate (#63), add an HTTP cache layer (Cache-Control with s-maxage) for public list routes, and give them a dedicated throttle.

Related: #11, #63

Activity

  1. added
    securitySecurity-related issue
    performancePerformance/optimization issue
    Stellar WaveIssues in the Stellar wave program
    and removed
    Stellar WaveIssues in the Stellar wave program
    on Oct 13, 2026
  2. Leemxiey commented on Oct 19, 2026

    @Leemxiey

    @Leemxiey has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    hi there, can u pls assign me on this issue

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Leemxiey to this issue.

  3. meloball9993-star commented on Oct 19, 2026

    @meloball9993-star
    Contributor

    @meloball9993-star has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi maintainer! I’d like to work on this issue. I’ve reviewed the requirements and would be happy to take it up. Please assign it to me.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @meloball9993-star to this issue.

  4. drips-wave commented on Oct 19, 2026

    @drips-wave

    Congratulations, @meloball9993-star! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

    🧑‍💻 @meloball9993-star: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

    Warning

    When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

    🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

    🌊 Happy Wave 🌊

  5. drips-wave commented on Oct 20, 2026

    @drips-wave

    This issue has been completed by @meloball9993-star as part of the Stellar Wave Program's 10th Wave 🥳

    😎 @meloball9993-star: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

    🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Stellar WaveIssues in the Stellar wave programperformancePerformance/optimization issuesecuritySecurity-related issue

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions