[Rajkumar2002-Rk]

Summary

The Limits section now says security rate limits still apply without billing, which covers the main point of #8452. This adds the one detail that's easy to trip over from scripts: the v2 API's per-IP limit before auth (V2_PREAUTH_IP_LIMIT in apps/sim/lib/api/server/routes/v2-json-route.ts: 600 burst, then 300 per minute), that Docker Compose hosts share the bridge gateway IP, and AUTH_TRUSTED_PROXIES behind a reverse proxy.

Refs #8452

Rebased on the current staging and trimmed to just that paragraph after the Limits rewrite.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

Docs only. Checked the numbers against V2_PREAUTH_IP_LIMIT on staging, and reproduced the limit on a self-hosted install with billing off: 800 quick requests to POST /api/v2/workflows/{id}/execute with an invalid key gave 600 × 401, then 429 with x-ratelimit-limit: 600.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (docs only, no tests affected)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

@Rajkumar2002-Rk is attempting to deploy a commit to the Sim Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Confidence Score: 4/5

[Low risk] Documents API rate limits in self-hosting guide.

The PR appears safe to merge, with a non-blocking documentation correction recommended.

Findings

1.  Other limits still apply ▶

Summary

The PR clarifies that disabling billing removes plan rate limits, then documents the v2 pre-authentication per-IP limit and deployment-specific IP handling.

• The v2 limit details agree with the implementation.
• The callout should not imply that v2 is the only route with a billing-independent limit.

_{Reviews (1) · Last reviewed commit: "docs(self-hosting): document the v2 per-..."}

[greptile-apps]

Other limits still apply

“One limit applies regardless of billing” makes the v2 limit sound like the only exception. Other routes have independent limits too: the contact endpoint, for example, enforces a per-IP limit. Operators investigating a 429 on those routes could mistakenly look to the listed plan variables for a way to change it. Please avoid presenting the v2 limit as the sole exception.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!