New account posting is rate-limited or delayed

A rate limit that applies equally to all accounts — new and established — provides no incremental protection against spam bots that register and immediately begin flooding. CWE-799 applies: the system fails to differentiate interaction frequency by account trust level. New accounts posting at the same rate as accounts with months of history is an anomaly signal that legitimate platforms exploit to catch automation. Reddit, Hacker News, and most major forums enforce reduced posting rates for new accounts specifically because this is the attack window that automated spam campaigns exploit most aggressively.

Implement tiered rate limits that apply stricter caps to accounts created within the last 7 days:

app.post('/api/posts', authenticate, async (req, res) => {
  const user = await db.users.findOneById(req.user.id);
  const accountAgeMs = Date.now() - user.createdAt.getTime();
  const isNewAccount = accountAgeMs < 7 * 24 * 60 * 60 * 1000;

  if (isNewAccount) {
    const postsInLastHour = await db.posts.count({
      where: {
        userId: user.id,
        createdAt: { gte: new Date(Date.now() - 3_600_000) },
      },
    });
    if (postsInLastHour >= 3) {
      return res.status(429).json({ error: 'New accounts are limited to 3 posts per hour.' });
    }
  }
  // ... create post
});

A flat rate limit that applies equally to all accounts does not satisfy this check — the differentiation between new and established accounts is the required signal.