Server settings
Rate limits
Per-scope request limits — login, password resets, messages, uploads, writes, search.
Each scope is a pair — how many requests, per what interval — enforced server-side and applied without restarts:
| Scope | Settings | Guards against |
|---|---|---|
| Login attempts | rateLoginLimit / …IntervalSeconds |
credential stuffing |
| Password resets | ratePasswordResetLimit / …IntervalSeconds |
reset-mail flooding |
| Two-factor codes | rateTwoFactorLimit / …IntervalSeconds |
brute-forcing TOTP/recovery codes |
| Message sends | rateMessageSendLimit / …IntervalSeconds |
spam floods |
| Attachment uploads | rateAttachmentUploadLimit / …IntervalSeconds |
storage abuse |
| API writes (generic) | rateApiWriteLimit / …IntervalSeconds |
scripted abuse |
| Search queries | rateSearchLimit |
expensive-query hammering |
Limits apply per user (per IP for unauthenticated scopes like login). When
a limit trips, the API returns 429 with a retry hint; the client
surfaces it to the user.
Tip
Limits are shared across all app processes (they live in the cache pool), so what you set is what an abuser gets — no per-worker multiplication.