Features

Rate Limiting

Overview

Rate limiting allows you to control the maximum number of requests per second that Pensar’s security agent makes during penetration testing. This is useful when testing against environments with strict rate limits or limited resources.

Enabling rate limiting will significantly increase scan duration. If your environment can handle unrestricted testing, disabling rate limits is recommended for faster results.

When to Use Rate Limiting

Shared Environments

When testing against staging or QA environments shared with other teams, rate limiting prevents resource contention.

Rate-Limited APIs

If your API has built-in rate limiting that blocks requests, configure the agent to stay under those thresholds.

Resource Constraints

For environments with limited compute or bandwidth, throttling requests prevents overload.

Production-Like Testing

When testing against production or production-like environments where stability is critical.

Configuring Rate Limits

2

Enable Rate Limiting

Toggle the Enable Rate Limiting switch to on.

3

Set Requests Per Second

Use the slider to configure the maximum requests per second (1-200 req/s):

  • 1 req/s: Very slow, use for extremely sensitive environments
  • 10-50 req/s: Moderate, good balance for shared environments
  • 100-200 req/s: Fast, suitable for dedicated test environments

Performance Impact

The rate limit directly affects scan duration:

Rate LimitRelative SpeedBest For
DisabledFastestDedicated test environments
100+ req/sFastMost testing scenarios
20-50 req/sModerateShared staging environments
1-10 req/sSlowProduction-adjacent or rate-limited APIs

Rate limiting applies to both HTTP requests and command executions during testing. The agent will wait to acquire a slot before making each request.

Recommendations

For optimal testing performance:

  1. Disable rate limits when possible - If your test environment can handle unrestricted traffic, leave rate limiting disabled for faster scans.

  2. Match your API’s limits - If your API enforces rate limits (e.g., 100 requests/minute), set the agent slightly below that threshold.

  3. Test during off-peak hours - Running scans during low-traffic periods allows for higher rate limits without impacting other users.

  4. Use dedicated test environments - Whenever possible, test against isolated environments where rate limiting isn’t necessary.