Batch submission attempts above 5 per 60 seconds trigger temp block and admin alert

Without batch rate limiting, a single IP can submit hundreds of listings per minute, flooding the moderation queue and making it impossible for human reviewers to process legitimate submissions. CWE-770 (Allocation of Resources Without Limits) and OWASP A05 (Security Misconfiguration) both apply. The cost is not just operational — spam that slips through moderation poisons the directory's data quality for every downstream user and search engine that indexes it.

Implement server-side rate limiting keyed by IP (and user ID when authenticated). Use an atomic increment in Redis so the counter survives across serverless cold starts:

// app/api/listings/submit/route.ts
import { Redis } from '@upstash/redis'

const redis = new Redis({ url: process.env.UPSTASH_REDIS_URL!, token: process.env.UPSTASH_REDIS_TOKEN! })

const ip = req.headers.get('x-forwarded-for') ?? 'unknown'
const key = `sub_rate:${ip}`
const count = await redis.incr(key)
if (count === 1) await redis.expire(key, 60) // 60-second window

if (count > 5) {
  await logSecurityEvent({ type: 'submission-rate-exceeded', ip, count })
  return Response.json({ error: 'Too many submissions — try again in a minute.' }, { status: 429 })
}

Send an admin alert (email or Slack webhook) when a single IP exceeds the threshold so patterns can be investigated and IPs permanently blocked if warranted.