# Batched request limit evasion

One request carrying many operations or arguments while the guard counts only once

_Area: Web business logic and race conditions. Seen in 2 disclosed reports; one confirmed bounty: $500; latest 2026-10-06. Updated 2026-10-31._

## How it works
A guard is written as if one request equals one operation. The limit is checked per request, per collection, or per call, but the request can carry many operations: aliased GraphQL mutations, flooded parameters, repeated fields. The guard fires once, the side effects multiply. The assumption that breaks is "one request = one counted action." When the counting point and the acting point differ, the excess is invisible to the guard.

## Where it shows up
- GraphQL endpoints accepting aliased mutations of the same field in one document [E2](https://bugbountylibrary.com/r/h1%3A2166697.md)
- Rate limits documented per request rather than per resolved operation [E2](https://bugbountylibrary.com/r/h1%3A2166697.md)
- WAF/parser code that silently returns when a collection hits a cap, with no error or flag set [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6r3q-mjv7-xr8m.md)
- Iteration over Go maps (randomized order) deciding which items survive a cap [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6r3q-mjv7-xr8m.md)
- First-party consoles/GraphiQL proxying admin APIs with broader scope than the UI enforces [E3](https://bugbountylibrary.com/r/h1%3A1257428.md)
- Any limit enforced at parse time but side effects applied at execution time

## How to review
Find every limit and ask: what unit is counted, and can one request contain more than one unit? The invariant that must hold: the number of side effects or counted items per request is bounded by the same counter the limit checks, and exceeding the cap produces an observable error or flag, never a silent drop. For GraphQL, count resolved mutations, not HTTP requests. For parsers, confirm the cap path sets a transaction-visible signal [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6r3q-mjv7-xr8m.md). For permission-gated mutations, confirm the console enforces the same scope as the documented API [E3](https://bugbountylibrary.com/r/h1%3A1257428.md).

## Variants seen
- Aliased GraphQL mutation batching to multiply report creation past a per-request limit [E2](https://bugbountylibrary.com/r/h1%3A2166697.md)
- Parameter flooding past an argument cap, with silent drop and randomized map order hiding payloads from ARGS rules [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6r3q-mjv7-xr8m.md)
- Privileged mutation reachable through a developer console despite documented restriction [E3](https://bugbountylibrary.com/r/h1%3A1257428.md)

## Impact and severity
Led to mass spam (thousands of reports) [E2](https://bugbountylibrary.com/r/h1%3A2166697.md), WAF rule bypass [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6r3q-mjv7-xr8m.md), and free credit minting [E3](https://bugbountylibrary.com/r/h1%3A1257428.md). Severity rises when the multiplied action is costly to the victim, when the bypass is silent (no error), and when randomization makes the surviving subset unpredictable [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-6r3q-mjv7-xr8m.md). Median bounty in evidence was modest, but impact scales with what the batched operation does.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-6r3q-mjv7-xr8m.md
- E2: https://bugbountylibrary.com/r/h1%3A2166697.md
- E3: https://bugbountylibrary.com/r/h1%3A1257428.md