Incident Dossier

Token bucket refills on every request

Rate-limit dashboards show no throttling even during sustained bursts. The gateway insists every request is allowed, and our abuse team can't reproduce the protection they expect from a token bucket.

Initial failing signalburst never throttlesExpected behavior: The third call in the same instant is denied. · actual behavior: The third call in the same instant is allowed.

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Compare how tokens should change between two calls in the same instant vs across time.
Find where the bucket state is mutated before decrement.
Refill based on elapsed wall time, capped at capacity, and preserve isolation between identities.

Focus Mode

Start

src/bucket.js

Likely area

src/bucket.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicReliability

DifficultyMedium

Est. time15 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace