---
title: "Abuse and limits · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits
updated: 2026-10-20
licence: "All rights reserved"
---

# Abuse and limits

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Limit how fast and how much anyone can ask for. Give the same answer either way, and check every price, step and count on the server.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits`.

## Required

- [Limit requests per client](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/limit-requests): Limit how many requests one client can send to costly routes, such as search, sign-up, exports, AI calls and anything that sends email.
- [Give the same answer for known and unknown accounts](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/no-account-enumeration): Login, sign-up and password reset must answer the same way whether or not the account exists, so nobody can find out who has an account.
- [Work out every amount on the server](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/server-side-business-rules): Never trust a price, quantity, discount or step order sent by the browser. The server works out every amount and checks that each step happened.
- [Make each change happen exactly once](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/race-conditions): Changes to money, stock and single-use items must happen once, even when the same request arrives twice at the same moment.
- [Cap the size of every request and answer](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/resource-limits): Put a ceiling on everything a client can make the server do, such as page sizes, upload sizes, query depth and pattern matching time.
- [Confirm payments on the server](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/confirm-payment-server-side): Mark an order as paid only after the payment provider confirms it through a signed webhook or its API. Never trust the return to your success page.

## Recommended

- [Stop spam and fake sign-ups](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/form-spam): Make forms costly for bots and cheap for people. Never let a form send unlimited email to addresses the visitor types in.
- [Protect free tiers from automated abuse](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/free-tier-abuse): Limit what one person can take from a free plan or trial, so scripts cannot create endless accounts to get free use.

- Previous: [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files)
- Next: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- [All chapters](https://agentwranglers.se/playbook/adversarial-testing)