Scraping rate limits configurable per-domain
Why it matters
Scrapers that make requests at full network speed to external domains violate the implicit contract of the web — and in many cases the explicit contract of a site's Terms of Service. Unthrottled scraping can constitute a denial-of-service condition under CWE-799 and may be interpreted as intentional interference under CFAA and GDPR Art. 6 (no lawful basis exists for extracting data via abusive request patterns). Rate limits that are hardcoded and non-configurable create a deploy bottleneck every time a domain operator asks you to slow down.
Severity rationale
High because unthrottled scraping against a target domain can expose the company to legal claims of unauthorized computer access and undermine the lawful basis for collected data under GDPR Art. 6.
Remediation
Define per-domain rate limits in src/config/sources.ts as configurable constants, then enforce them in every scraper with an explicit await sleep(delay) before each request.
// src/config/sources.ts
export const SCRAPER_RATE_LIMITS: Record<string, number> = {
'linkedin.com': 3000, // 3 s between requests
'default': 2000, // 2 s for all other domains
}
// In each scraper:
const domain = new URL(targetUrl).hostname
const delay = SCRAPER_RATE_LIMITS[domain] ?? SCRAPER_RATE_LIMITS['default']
await sleep(delay)
const response = await fetch(targetUrl)
Minimum acceptable default delay is 1000 ms. The configuration must be external to the scraper logic itself so it can be adjusted without a code change.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Data Sourcing & Provenance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 6 — Lawfulness of processing — scraping without rate limits may violate ToS and undermine lawful basis
- cwe · CWE-799 — Improper Control of Interaction Frequency
Taxons
History
- 2026-04-18·v1.0.0·Initial import from data-sourcing-provenance·automated