Rate Limiting Has Three Distinct Layers, and Most Systems Only Use One

A software developer building two separate platforms — LogicVisor, a public AI code-review tool, and Titan, a payments system — found that effective rate limiting requires three distinct layers rather than a single strategy. Client-side controls like debouncing or disabling submit buttons improve user experience but offer no real security, as malicious actors can bypass JavaScript entirely. LogicVisor, which allows anonymous users three free reviews, stacks multiple server-side checks before any paid AI call is made, including IP-based limits, session tracking, browser fingerprinting, and result caching via code hashing. Rather than returning a hard 429 error during traffic spikes, the system degrades gracefully by serving a basic non-AI response to authenticated users. The key insight is that abuse prevention, cost control through deduplication, and graceful degradation are separate mechanisms that each protect different resources and carry different trade-offs.