chore: raise read rate limits (v2.0.2)

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.2] - 2026-07-14
+
+### Changed
+
+- **Per-IP rate limit on status/list endpoints**: increased to ~100 req/s with a burst of 200 (was burst 100, then ~1/s refill). Stops Explorer CI from 429ing while paging `/verified-programs`.
+
 ## [2.0.1] - 2026-07-13
 
 ### Fixed

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "verified_programs_api"
-version = "2.0.1"
+version = "2.0.2"
 edition = "2021"
 
 [dependencies]

README.md

@@ -100,7 +100,7 @@ curl https://verify.osec.io/resolve-hash/29e7713aa3c48e242e2847bc031fe2a03eb61aa
 ### Rate Limits
 
 - **Verification endpoints**: 5 requests/second globally, 1 request per 30 seconds per IP
-- **Status/query endpoints**: 10,000 requests/second globally, 100 requests/second per IP
+- **Status/query endpoints**: 10,000 requests/second globally, ~100 requests/second per IP (burst 200)
 - **Webhook endpoints** (`/pda`, `/unverify`): not rate limited; require a valid `AUTHORIZATION` header instead
 
 ### Security

src/api/routes.rs

@@ -42,11 +42,11 @@ pub fn initialize_router(state: AppState) -> Router {
             .layer(RateLimitLayer::new(req_per_sec, Duration::from_secs(1)))
     };
 
-    let rate_limit_per_ip = |timeout: u64, limit: u32| {
+    let rate_limit_per_ip = |period: Duration, burst: u32| {
         let config = Arc::new(
             GovernorConfigBuilder::default()
-                .per_second(timeout)
-                .burst_size(limit)
+                .period(period)
+                .burst_size(burst)
                 .use_headers()
                 .key_extractor(SmartIpKeyExtractor)
                 .finish()
@@ -122,7 +122,7 @@ pub fn initialize_router(state: AppState) -> Router {
         .layer(
             global_rate_limit(5)
                 .layer(CompressionLayer::new().zstd(true))
-                .layer(rate_limit_per_ip(30, 1))
+                .layer(rate_limit_per_ip(Duration::from_secs(30), 1))
                 .layer(cors(Method::POST)),
         );
 
@@ -145,7 +145,8 @@ pub fn initialize_router(state: AppState) -> Router {
         .layer(
             global_rate_limit(10000)
                 .layer(CompressionLayer::new().zstd(true))
-                .layer(rate_limit_per_ip(1, 100))
+                // ~100 req/s per IP, burst 200 (was burst 100 then ~1/s refill).
+                .layer(rate_limit_per_ip(Duration::from_millis(10), 200))
                 .layer(cors(Method::GET)),
         );