framework:
    rate_limiter:
        # Keyed by IP in AuthController::register(); prevents mass account
        # creation from a single source. Single-instance deployment, so the
        # default in-memory/cache storage is fine — switch the `cache_pool`
        # to a Redis-backed pool if this ever runs behind a load balancer.
        register_ip:
            policy: 'sliding_window'
            limit: 5
            interval: '1 hour'
        # Same shape as register_ip, guarding the other public endpoints that
        # trigger an outbound email (resend-verification / forgot-password).
        resend_verification_ip:
            policy: 'sliding_window'
            limit: 5
            interval: '1 hour'
        forgot_password_ip:
            policy: 'sliding_window'
            limit: 5
            interval: '1 hour'
        # Keyed by user email (authenticated endpoint) instead of IP — stops a
        # hijacked session from spamming the account owner with confirmation
        # emails regardless of which IP the requests come from.
        password_change_user:
            policy: 'sliding_window'
            limit: 5
            interval: '1 hour'
