SMS send routes are rate-limited

SMS is the most expensive metered communication channel in a typical web stack — Twilio charges $0.0079–$0.02 per outbound message, and there is no free tier for abuse. An SMS route without per-IP rate limiting lets an attacker trigger thousands of messages per minute, reaching four-digit charges before any alert fires. CWE-799 (Improper Control of Interaction Frequency) is the direct mapping, alongside OWASP A05:2021. Beyond direct billing, carriers flag high-volume spammy senders for grey-listing or number suspension, destroying your transactional SMS deliverability for legitimate users. This is a cost bomb that also breaks a security-critical channel (OTP delivery).

Add per-IP rate limiting at the route level before the Twilio client is called. Three sends per hour per IP is generous for legitimate OTP flows and stops abuse cold.

import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'
import twilio from 'twilio'

const limiter = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.fixedWindow(3, '1 h'),
})

const client = twilio(process.env.TWILIO_SID!, process.env.TWILIO_AUTH_TOKEN!)

export async function POST(req: Request) {
  const ip = req.headers.get('x-forwarded-for') ?? 'anon'
  const { success } = await limiter.limit(`sms:${ip}`)
  if (!success) return Response.json({ error: 'Rate limited' }, { status: 429 })
  const { to, body } = SMSSchema.parse(await req.json())
  await client.messages.create({ to, from: process.env.TWILIO_FROM!, body })
  return Response.json({ sent: true })
}