API Scrape Postmortem: How 251 Requests Nearly Drained a Database

An attacker made 251 requests to a visa API, extracting 0.6% of its 39,585-pair database before the key was revoked. The requests showed a methodical pattern: one passport fully scraped at ~25 requests per minute, then a move to the next. The incident highlights that rate limits are cost controls, not security measures, and that logging must capture network-level data to block repeat offenders.