deploy-checkup 0.1.1__tar.gz → 0.2.0__tar.gz

{deploy_checkup-0.1.1/src/deploy_checkup.egg-info → deploy_checkup-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deploy-checkup
-Version: 0.1.1
+Version: 0.2.0
 Summary: Check whether your deployed app is set up safely, in plain language, with fixes for your host.
 Author: Nandhagopal
 License-Expression: MIT
@@ -58,6 +58,8 @@ deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrende
 | `--api` | Your API's address, if it is separate |
 | `--health-path` | The API's health check path (default `/health`) |
 | `--yes-i-own-it` | Run the probing checks without asking (for CI) |
+| `--active` | Also run the active rate-limit test (needs your permission too) |
+| `--rate-limit-path` | The path the rate-limit test sends its burst to (default: the health path) |
 | `--json` | Print the findings as JSON instead of a coloured report |
 | `-V`, `--version` | Show the version |
 | `-h`, `--help` | Show help |
@@ -88,11 +90,28 @@ The command exits with code `1` if anything fails and `0` otherwise.
 
 ### Use it in CI
 
-Run it after each deploy, so a broken setup fails the pipeline. For example, in GitHub Actions:
+Run it after each deploy, so a broken setup fails the pipeline. In GitHub Actions, use the action:
 
 ```yaml
-- run: pip install deploy-checkup
-- run: deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --yes-i-own-it
+- uses: Nandhagopal2912/deploy-checkup@v0.2.0
+  with:
+    url: https://your-frontend.onrender.com
+    api: https://your-api.onrender.com
+    i-own-it: "true"
+```
+
+| Input | Meaning |
+|---|---|
+| `url` | Your frontend's address (required) |
+| `api` | Your API's address, if it is separate |
+| `health-path` | The API's health check path (default `/health`) |
+| `i-own-it` | `"true"` also runs the probing checks. Only for apps you own or have permission to test. |
+
+Anywhere else, install and run the command directly:
+
+```bash
+pip install deploy-checkup
+deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --yes-i-own-it
 ```
 
 `--yes-i-own-it` runs the probing checks without the question nobody can answer in CI. Leave it out to run only the gentle checks.
@@ -108,6 +127,7 @@ Run it after each deploy, so a broken setup fails the pipeline. For example, in
 | **health** | API | Calls the health path 3 times. Does it exist, and what's the median response time? |
 | **cold_start** | API | Was the first of those requests much slower than the rest (a free tier waking up)? Reported as a hint, not a verdict. |
 | **exposed_files** | frontend and API | Can anyone download `/.env` or `/.git/config`? **Probing:** runs only after you confirm you own the site. |
+| **rate_limit** | API (or frontend) | Once the rate limit blocks you, does a fake `X-Forwarded-For` get you unblocked? **Active:** runs only with `--active` and your permission. |
 
 The headers check skips the API on purpose: a JSON API doesn't need CSP or X-Frame-Options, and flagging them would be a false alarm.
 
@@ -117,16 +137,28 @@ The headers check skips the API on purpose: a JSON API doesn't need CSP or X-Fra
 
 Most checks send ordinary requests any browser could send. The exposed files check asks for paths like `/.env`, which on someone else's site can look like an attack. So deploy-checkup asks *"Do you own this site?"* before running it. If nobody can answer (in CI, for example), it is skipped and the report says so, unless you pass `--yes-i-own-it`. A leaked file's contents are never shown in the report.
 
+### The active rate-limit test
+
+Many apps limit how often one visitor can call them, and identify the visitor by the `X-Forwarded-For` header. But visitors can write that header themselves. If the app trusts the first entry, anyone can bypass the limit by sending a different fake IP each time.
+
+With `--active`, deploy-checkup:
+
+1. sends normal requests until the app answers `429 Too Many Requests` (at most 60),
+2. sends one request with a fake `X-Forwarded-For: 203.0.113.7` (an address reserved for documentation, never a real visitor),
+3. sends one more normal request, to confirm you're still blocked.
+
+If the fake request gets through while you're still blocked, the limit can be bypassed. The test defaults to the health path, because it's cheap to call; never point `--rate-limit-path` at an endpoint that costs money per request. Afterwards, your own IP may stay blocked on that app for up to a minute.
+
 ### Polite by design
 
-Every request uses a 60-second timeout (Render's free tier can take about 50 seconds to wake up) and identifies itself as `User-Agent: DeployCheckup/<version>`, so site owners can see what called them. A full run sends a few dozen ordinary requests.
+Every request uses a 60-second timeout (Render's free tier can take about 50 seconds to wake up) and identifies itself as `User-Agent: DeployCheckup/<version>`, so site owners can see what called them. A normal run sends a few dozen ordinary requests; `--active` adds at most 62 more.
 
 ### What it doesn't do
 
 deploy-checkup is a quick first look, not a full security audit:
 
-- It only sends ordinary requests. It doesn't try to break in, and it isn't a replacement for tools like OWASP ZAP.
-- CORS is tested on the one API address you give it, and health on one path.
+- It doesn't try to break in, and it isn't a replacement for tools like OWASP ZAP. Apart from the opt-in rate-limit test, it only sends ordinary requests.
+- CORS is tested on the one API address you give it, health on one path, and the rate limit on one path with one fake header (`X-Forwarded-For`).
 - Cold start detection is a guess from a few timings.
 - Fix hints are written for Render first; other hosts get general advice.
 
@@ -141,7 +173,7 @@ deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrende
 ```json
 {
   "tool": "deploy-checkup",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "targets": [
     {
       "url": "https://your-api.onrender.com",

{deploy_checkup-0.1.1 → deploy_checkup-0.2.0}/README.md

@@ -28,6 +28,8 @@ deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrende
 | `--api` | Your API's address, if it is separate |
 | `--health-path` | The API's health check path (default `/health`) |
 | `--yes-i-own-it` | Run the probing checks without asking (for CI) |
+| `--active` | Also run the active rate-limit test (needs your permission too) |
+| `--rate-limit-path` | The path the rate-limit test sends its burst to (default: the health path) |
 | `--json` | Print the findings as JSON instead of a coloured report |
 | `-V`, `--version` | Show the version |
 | `-h`, `--help` | Show help |
@@ -58,11 +60,28 @@ The command exits with code `1` if anything fails and `0` otherwise.
 
 ### Use it in CI
 
-Run it after each deploy, so a broken setup fails the pipeline. For example, in GitHub Actions:
+Run it after each deploy, so a broken setup fails the pipeline. In GitHub Actions, use the action:
 
 ```yaml
-- run: pip install deploy-checkup
-- run: deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --yes-i-own-it
+- uses: Nandhagopal2912/deploy-checkup@v0.2.0
+  with:
+    url: https://your-frontend.onrender.com
+    api: https://your-api.onrender.com
+    i-own-it: "true"
+```
+
+| Input | Meaning |
+|---|---|
+| `url` | Your frontend's address (required) |
+| `api` | Your API's address, if it is separate |
+| `health-path` | The API's health check path (default `/health`) |
+| `i-own-it` | `"true"` also runs the probing checks. Only for apps you own or have permission to test. |
+
+Anywhere else, install and run the command directly:
+
+```bash
+pip install deploy-checkup
+deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --yes-i-own-it
 ```
 
 `--yes-i-own-it` runs the probing checks without the question nobody can answer in CI. Leave it out to run only the gentle checks.
@@ -78,6 +97,7 @@ Run it after each deploy, so a broken setup fails the pipeline. For example, in
 | **health** | API | Calls the health path 3 times. Does it exist, and what's the median response time? |
 | **cold_start** | API | Was the first of those requests much slower than the rest (a free tier waking up)? Reported as a hint, not a verdict. |
 | **exposed_files** | frontend and API | Can anyone download `/.env` or `/.git/config`? **Probing:** runs only after you confirm you own the site. |
+| **rate_limit** | API (or frontend) | Once the rate limit blocks you, does a fake `X-Forwarded-For` get you unblocked? **Active:** runs only with `--active` and your permission. |
 
 The headers check skips the API on purpose: a JSON API doesn't need CSP or X-Frame-Options, and flagging them would be a false alarm.
 
@@ -87,16 +107,28 @@ The headers check skips the API on purpose: a JSON API doesn't need CSP or X-Fra
 
 Most checks send ordinary requests any browser could send. The exposed files check asks for paths like `/.env`, which on someone else's site can look like an attack. So deploy-checkup asks *"Do you own this site?"* before running it. If nobody can answer (in CI, for example), it is skipped and the report says so, unless you pass `--yes-i-own-it`. A leaked file's contents are never shown in the report.
 
+### The active rate-limit test
+
+Many apps limit how often one visitor can call them, and identify the visitor by the `X-Forwarded-For` header. But visitors can write that header themselves. If the app trusts the first entry, anyone can bypass the limit by sending a different fake IP each time.
+
+With `--active`, deploy-checkup:
+
+1. sends normal requests until the app answers `429 Too Many Requests` (at most 60),
+2. sends one request with a fake `X-Forwarded-For: 203.0.113.7` (an address reserved for documentation, never a real visitor),
+3. sends one more normal request, to confirm you're still blocked.
+
+If the fake request gets through while you're still blocked, the limit can be bypassed. The test defaults to the health path, because it's cheap to call; never point `--rate-limit-path` at an endpoint that costs money per request. Afterwards, your own IP may stay blocked on that app for up to a minute.
+
 ### Polite by design
 
-Every request uses a 60-second timeout (Render's free tier can take about 50 seconds to wake up) and identifies itself as `User-Agent: DeployCheckup/<version>`, so site owners can see what called them. A full run sends a few dozen ordinary requests.
+Every request uses a 60-second timeout (Render's free tier can take about 50 seconds to wake up) and identifies itself as `User-Agent: DeployCheckup/<version>`, so site owners can see what called them. A normal run sends a few dozen ordinary requests; `--active` adds at most 62 more.
 
 ### What it doesn't do
 
 deploy-checkup is a quick first look, not a full security audit:
 
-- It only sends ordinary requests. It doesn't try to break in, and it isn't a replacement for tools like OWASP ZAP.
-- CORS is tested on the one API address you give it, and health on one path.
+- It doesn't try to break in, and it isn't a replacement for tools like OWASP ZAP. Apart from the opt-in rate-limit test, it only sends ordinary requests.
+- CORS is tested on the one API address you give it, health on one path, and the rate limit on one path with one fake header (`X-Forwarded-For`).
 - Cold start detection is a guess from a few timings.
 - Fix hints are written for Render first; other hosts get general advice.
 
@@ -111,7 +143,7 @@ deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrende
 ```json
 {
   "tool": "deploy-checkup",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "targets": [
     {
       "url": "https://your-api.onrender.com",

{deploy_checkup-0.1.1 → deploy_checkup-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deploy-checkup"
-version = "0.1.1"
+version = "0.2.0"
 description = "Check whether your deployed app is set up safely, in plain language, with fixes for your host."
 readme = "README.md"
 license = "MIT"

deploy_checkup-0.2.0/src/deploy_checkup/checks/rate_limit.py

@@ -0,0 +1,96 @@
+import httpx
+
+from deploy_checkup.models import Finding, Level, could_not_finish
+
+CHECK = "rate_limit"
+MAX_REQUESTS = 60  # never send more than this to find the limit
+FAKE_IP = "203.0.113.7"  # TEST-NET-3: reserved for documentation, never a real visitor
+
+
+def check_rate_limit(client: httpx.Client, url: str, path: str) -> list[Finding]:
+    """Hit the rate limit, then pretend to be someone else with a fake X-Forwarded-For.
+
+    If the fake header gets through while a normal request is still blocked, anyone
+    can bypass the limit by writing a new fake IP into every request.
+    """
+    target = httpx.URL(url).join(path)
+    try:
+        for sent in range(1, MAX_REQUESTS + 1):
+            if client.get(target).status_code == 429:
+                break
+        else:
+            return [_no_limit_found(target.path)]
+
+        spoofed = client.get(target, headers={"X-Forwarded-For": FAKE_IP})
+        again = client.get(target)
+    except httpx.RequestError as error:
+        return [could_not_finish(CHECK, error)]
+
+    if spoofed.status_code == 429:
+        return [
+            Finding(
+                check=CHECK,
+                level=Level.PASS,
+                title=(
+                    f"Rate limit on {target.path} can't be bypassed with a fake "
+                    f"X-Forwarded-For (limited after {sent} requests)"
+                ),
+            )
+        ]
+    if again.status_code == 429:
+        return [_bypassable(target.path)]
+    return [_inconclusive(target.path)]
+
+
+def _bypassable(path: str) -> Finding:
+    return Finding(
+        check=CHECK,
+        level=Level.FAIL,
+        title=f"Rate limit on {path} can be bypassed with a fake X-Forwarded-For",
+        why=(
+            "Anyone can send unlimited requests by writing a different fake IP into each one, "
+            "so the limit doesn't protect you from abuse or from surprise bills."
+        ),
+        fix=(
+            "Read the visitor's IP from the right of X-Forwarded-For, skipping exactly as many "
+            "entries as your host's proxies add. Never trust the first entry: the visitor wrote it."
+        ),
+        render_fix=(
+            "On Render a request passes Cloudflare, Render's load balancer and an internal proxy, "
+            "so the visitor is 3rd from the right of X-Forwarded-For (measured October 2026). "
+            "Take that entry, never the first one."
+        ),
+    )
+
+
+def _no_limit_found(path: str) -> Finding:
+    return Finding(
+        check=CHECK,
+        level=Level.INFO,
+        title=f"No rate limit hit on {path} after {MAX_REQUESTS} requests",
+        why="Either there's no limit, or it's higher than this test goes.",
+        fix=(
+            "If this endpoint does real work, such as sending email or calling a paid API, "
+            "add a per-visitor rate limit. Use --rate-limit-path to test a limited endpoint."
+        ),
+    )
+
+
+def _inconclusive(path: str) -> Finding:
+    return Finding(
+        check=CHECK,
+        level=Level.WARNING,
+        title=f"Couldn't tell whether the rate limit on {path} can be bypassed",
+        why="The limit reset during the test, so the fake X-Forwarded-For result doesn't prove anything.",
+        fix="Run the test again in a minute.",
+    )
+
+
+def skipped() -> Finding:
+    return Finding(
+        check=CHECK,
+        level=Level.INFO,
+        title="Rate limit test skipped (needs your permission)",
+        why="It sends a burst of requests and fake headers, which only the site's owner should do.",
+        fix="Run again and answer yes, or pass --yes-i-own-it together with --active.",
+    )

{deploy_checkup-0.1.1 → deploy_checkup-0.2.0}/src/deploy_checkup/cli.py

@@ -37,6 +37,15 @@ def main(
         action="store_true",
         help="skip the permission question and run the probing checks (for CI)",
     )
+    parser.add_argument(
+        "--active",
+        action="store_true",
+        help="also run the active rate-limit test (sends up to 62 requests; needs your permission)",
+    )
+    parser.add_argument(
+        "--rate-limit-path",
+        help="the path the active test sends its burst to (default: the health path)",
+    )
     parser.add_argument(
         "--json",
         action="store_true",
@@ -44,9 +53,17 @@ def main(
     )
     args = parser.parse_args(argv)
 
-    probe = _has_permission(args.url, args.yes_i_own_it, ask)
+    probe = _has_permission(args.url, args.yes_i_own_it, args.active, ask)
     with client or make_client() as http:
-        results = run_checks(http, args.url, args.api, args.health_path, probe)
+        results = run_checks(
+            http,
+            args.url,
+            args.api,
+            args.health_path,
+            probe,
+            args.active,
+            args.rate_limit_path,
+        )
 
     if args.json:
         print(to_json(results))
@@ -55,17 +72,23 @@ def main(
     return exit_code(results)
 
 
-def _has_permission(url: str, yes_i_own_it: bool, ask: Callable[[str], str] | None) -> bool:
-    """Probing checks run only with a flag or a typed "yes"; never by accident."""
+def _has_permission(
+    url: str, yes_i_own_it: bool, active: bool, ask: Callable[[str], str] | None
+) -> bool:
+    """Probing and active checks run only with a flag or a typed "yes"; never by accident."""
     if yes_i_own_it:
         return True
     if ask is None:
         if not sys.stdin.isatty():
             return False  # nobody is there to answer, for example in CI
         ask = _ask_on_stderr
+
+    what = "exposed files like /.env"
+    if active:
+        what += " and run the rate-limit test (a burst of up to 62 requests)"
     try:
         answer = ask(
-            f"Also check {url} for exposed files like /.env? "
+            f"Also check {url} for {what}? "
             "Only say yes if you own this site or have permission to test it. [y/N] "
         )
     except EOFError:

{deploy_checkup-0.1.1 → deploy_checkup-0.2.0}/src/deploy_checkup/runner.py

@@ -2,7 +2,7 @@ from importlib.metadata import version
 
 import httpx
 
-from deploy_checkup.checks import exposed_files
+from deploy_checkup.checks import exposed_files, rate_limit
 from deploy_checkup.checks.cors import check_cors
 from deploy_checkup.checks.headers import check_headers
 from deploy_checkup.checks.health import check_health
@@ -26,19 +26,23 @@ def run_checks(
     api_url: str | None = None,
     health_path: str = "/health",
     probe: bool = False,
+    active: bool = False,
+    rate_limit_path: str | None = None,
 ) -> dict[str, list[Finding]]:
     """Run every check and group the findings by the address they're about.
 
     probe=True also runs the probing checks, which only the site's owner should run.
+    active=True adds the active checks; they also need probe=True (the owner's permission).
     """
     frontend = check_reachable(client, url) + check_https(client, url) + check_headers(client, url)
     if probe:
         frontend += exposed_files.check_exposed_files(client, url)
     else:
         frontend.append(exposed_files.skipped())
-    results = {url: fixes_for_host(frontend, detect_host(client, url))}
+    results = {url: frontend}
 
-    if api_url and api_url != url:
+    has_api = api_url is not None and api_url != url
+    if has_api:
         # Health goes first: its first request is the one that can catch a cold start.
         api = (
             check_health(client, api_url, health_path)
@@ -47,10 +51,23 @@ def run_checks(
         )
         if probe:
             api += exposed_files.check_exposed_files(client, api_url)
-        results[api_url] = fixes_for_host(api, detect_host(client, api_url))
+        results[api_url] = api
 
-    return results
+    if active:
+        # Last, so the burst of requests can't slow down or block the other checks.
+        target = api_url if has_api else url
+        if probe:
+            results[target] += rate_limit.check_rate_limit(
+                client, target, rate_limit_path or health_path
+            )
+        else:
+            results[target].append(rate_limit.skipped())
 
+    return {
+        address: fixes_for_host(findings, detect_host(client, address))
+        for address, findings in results.items()
+    }
+    
 
 def exit_code(results: dict[str, list[Finding]]) -> int:
     """1 if anything failed, otherwise 0, so CI can stop a broken deploy."""

{deploy_checkup-0.1.1 → deploy_checkup-0.2.0/src/deploy_checkup.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deploy-checkup
-Version: 0.1.1
+Version: 0.2.0
 Summary: Check whether your deployed app is set up safely, in plain language, with fixes for your host.
 Author: Nandhagopal
 License-Expression: MIT
@@ -58,6 +58,8 @@ deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrende
 | `--api` | Your API's address, if it is separate |
 | `--health-path` | The API's health check path (default `/health`) |
 | `--yes-i-own-it` | Run the probing checks without asking (for CI) |
+| `--active` | Also run the active rate-limit test (needs your permission too) |
+| `--rate-limit-path` | The path the rate-limit test sends its burst to (default: the health path) |
 | `--json` | Print the findings as JSON instead of a coloured report |
 | `-V`, `--version` | Show the version |
 | `-h`, `--help` | Show help |
@@ -88,11 +90,28 @@ The command exits with code `1` if anything fails and `0` otherwise.
 
 ### Use it in CI
 
-Run it after each deploy, so a broken setup fails the pipeline. For example, in GitHub Actions:
+Run it after each deploy, so a broken setup fails the pipeline. In GitHub Actions, use the action:
 
 ```yaml
-- run: pip install deploy-checkup
-- run: deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --yes-i-own-it
+- uses: Nandhagopal2912/deploy-checkup@v0.2.0
+  with:
+    url: https://your-frontend.onrender.com
+    api: https://your-api.onrender.com
+    i-own-it: "true"
+```
+
+| Input | Meaning |
+|---|---|
+| `url` | Your frontend's address (required) |
+| `api` | Your API's address, if it is separate |
+| `health-path` | The API's health check path (default `/health`) |
+| `i-own-it` | `"true"` also runs the probing checks. Only for apps you own or have permission to test. |
+
+Anywhere else, install and run the command directly:
+
+```bash
+pip install deploy-checkup
+deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --yes-i-own-it
 ```
 
 `--yes-i-own-it` runs the probing checks without the question nobody can answer in CI. Leave it out to run only the gentle checks.
@@ -108,6 +127,7 @@ Run it after each deploy, so a broken setup fails the pipeline. For example, in
 | **health** | API | Calls the health path 3 times. Does it exist, and what's the median response time? |
 | **cold_start** | API | Was the first of those requests much slower than the rest (a free tier waking up)? Reported as a hint, not a verdict. |
 | **exposed_files** | frontend and API | Can anyone download `/.env` or `/.git/config`? **Probing:** runs only after you confirm you own the site. |
+| **rate_limit** | API (or frontend) | Once the rate limit blocks you, does a fake `X-Forwarded-For` get you unblocked? **Active:** runs only with `--active` and your permission. |
 
 The headers check skips the API on purpose: a JSON API doesn't need CSP or X-Frame-Options, and flagging them would be a false alarm.
 
@@ -117,16 +137,28 @@ The headers check skips the API on purpose: a JSON API doesn't need CSP or X-Fra
 
 Most checks send ordinary requests any browser could send. The exposed files check asks for paths like `/.env`, which on someone else's site can look like an attack. So deploy-checkup asks *"Do you own this site?"* before running it. If nobody can answer (in CI, for example), it is skipped and the report says so, unless you pass `--yes-i-own-it`. A leaked file's contents are never shown in the report.
 
+### The active rate-limit test
+
+Many apps limit how often one visitor can call them, and identify the visitor by the `X-Forwarded-For` header. But visitors can write that header themselves. If the app trusts the first entry, anyone can bypass the limit by sending a different fake IP each time.
+
+With `--active`, deploy-checkup:
+
+1. sends normal requests until the app answers `429 Too Many Requests` (at most 60),
+2. sends one request with a fake `X-Forwarded-For: 203.0.113.7` (an address reserved for documentation, never a real visitor),
+3. sends one more normal request, to confirm you're still blocked.
+
+If the fake request gets through while you're still blocked, the limit can be bypassed. The test defaults to the health path, because it's cheap to call; never point `--rate-limit-path` at an endpoint that costs money per request. Afterwards, your own IP may stay blocked on that app for up to a minute.
+
 ### Polite by design
 
-Every request uses a 60-second timeout (Render's free tier can take about 50 seconds to wake up) and identifies itself as `User-Agent: DeployCheckup/<version>`, so site owners can see what called them. A full run sends a few dozen ordinary requests.
+Every request uses a 60-second timeout (Render's free tier can take about 50 seconds to wake up) and identifies itself as `User-Agent: DeployCheckup/<version>`, so site owners can see what called them. A normal run sends a few dozen ordinary requests; `--active` adds at most 62 more.
 
 ### What it doesn't do
 
 deploy-checkup is a quick first look, not a full security audit:
 
-- It only sends ordinary requests. It doesn't try to break in, and it isn't a replacement for tools like OWASP ZAP.
-- CORS is tested on the one API address you give it, and health on one path.
+- It doesn't try to break in, and it isn't a replacement for tools like OWASP ZAP. Apart from the opt-in rate-limit test, it only sends ordinary requests.
+- CORS is tested on the one API address you give it, health on one path, and the rate limit on one path with one fake header (`X-Forwarded-For`).
 - Cold start detection is a guess from a few timings.
 - Fix hints are written for Render first; other hosts get general advice.
 
@@ -141,7 +173,7 @@ deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrende
 ```json
 {
   "tool": "deploy-checkup",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "targets": [
     {
       "url": "https://your-api.onrender.com",

{deploy_checkup-0.1.1 → deploy_checkup-0.2.0}/src/deploy_checkup.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ src/deploy_checkup/checks/exposed_files.py
 src/deploy_checkup/checks/headers.py
 src/deploy_checkup/checks/health.py
 src/deploy_checkup/checks/https.py
+src/deploy_checkup/checks/rate_limit.py
 src/deploy_checkup/checks/reachable.py
 tests/test_cli.py
 tests/test_cold_start.py
@@ -31,6 +32,7 @@ tests/test_health.py
 tests/test_hosts.py
 tests/test_https.py
 tests/test_models.py
+tests/test_rate_limit.py
 tests/test_reachable.py
 tests/test_report.py
 tests/test_runner.py

{deploy_checkup-0.1.1 → deploy_checkup-0.2.0}/tests/test_cli.py

@@ -105,4 +105,15 @@ def test_permission_question_goes_to_stderr(capsys, monkeypatch):
     captured = capsys.readouterr()
     assert answer == "y"
     assert captured.err == "Own it? "
-    assert captured.out == ""
+    assert captured.out == ""
+
+def test_active_question_mentions_the_burst(capsys):
+    questions = []
+
+    def remember(prompt):
+        questions.append(prompt)
+        return "n"
+
+    main(["https://example.com", "--active"], client=fake_client(healthy_site), ask=remember)
+
+    assert "rate-limit test" in questions[0]

deploy_checkup-0.2.0/tests/test_rate_limit.py

@@ -0,0 +1,92 @@
+from collections import defaultdict
+
+import httpx
+
+from deploy_checkup.checks.rate_limit import FAKE_IP, MAX_REQUESTS, check_rate_limit
+from deploy_checkup.models import Level
+
+URL = "https://api.example.com"
+LIMIT = 5
+
+
+def limiter(trusts_first_entry):
+    """A fake API with a 5-request limit per visitor.
+
+    trusts_first_entry=True copies the bug: it believes the first X-Forwarded-For entry.
+    """
+    hits = defaultdict(int)
+
+    def handler(request):
+        forwarded = request.headers.get("x-forwarded-for")
+        visitor = forwarded.split(",")[0] if trusts_first_entry and forwarded else "real-visitor"
+        hits[visitor] += 1
+        return httpx.Response(429 if hits[visitor] > LIMIT else 200)
+
+    return handler
+
+
+def check(handler):
+    return check_rate_limit(httpx.Client(transport=httpx.MockTransport(handler)), URL, "/health")
+
+
+def test_limit_that_trusts_the_first_entry_fails():
+    [finding] = check(limiter(trusts_first_entry=True))
+
+    assert finding.level == Level.FAIL
+    assert "/health" in finding.title
+
+
+def test_limit_that_ignores_fake_entries_passes():
+    [finding] = check(limiter(trusts_first_entry=False))
+
+    assert finding.level == Level.PASS
+    assert f"limited after {LIMIT + 1} requests" in finding.title
+
+
+def test_no_limit_stops_at_the_cap():
+    calls = []
+
+    def handler(request):
+        calls.append(request)
+        return httpx.Response(200)
+
+    [finding] = check(handler)
+
+    assert finding.level == Level.INFO
+    assert len(calls) == MAX_REQUESTS
+
+
+def test_fake_ip_is_a_documentation_address():
+    seen = []
+    api = limiter(trusts_first_entry=False)
+
+    def handler(request):
+        seen.append(request.headers.get("x-forwarded-for"))
+        return api(request)
+
+    check(handler)
+
+    assert FAKE_IP.startswith("203.0.113.")
+    assert seen.count(FAKE_IP) == 1
+
+
+def test_limit_resetting_mid_test_is_inconclusive():
+    calls = []
+
+    def handler(request):
+        calls.append(request)
+        return httpx.Response(429 if len(calls) == LIMIT + 1 else 200)
+
+    [finding] = check(handler)
+
+    assert finding.level == Level.WARNING
+
+
+def test_network_error_is_reported_not_hidden():
+    def handler(request):
+        raise httpx.ReadTimeout("timed out", request=request)
+
+    [finding] = check(handler)
+
+    assert finding.level == Level.INFO
+    assert "Couldn't finish the rate_limit check" in finding.title

{deploy_checkup-0.1.1 → deploy_checkup-0.2.0}/tests/test_runner.py

@@ -47,4 +47,36 @@ def test_same_address_for_frontend_and_api_keeps_frontend_findings():
     results = run_checks(client, "https://example.com", "https://example.com")
 
     assert list(results) == ["https://example.com"]
-    assert any(f.check == "headers" for f in results["https://example.com"])
+    assert any(f.check == "headers" for f in results["https://example.com"])
+
+def test_active_test_runs_on_the_api_with_permission():
+    client = fake_client(lambda request: httpx.Response(200))
+
+    results = run_checks(
+        client, "https://example.com", "https://api.example.com", probe=True, active=True
+    )
+
+    assert any(f.check == "rate_limit" for f in results["https://api.example.com"])
+    assert not any(f.check == "rate_limit" for f in results["https://example.com"])
+
+
+def test_active_test_is_skipped_without_permission():
+    calls = []
+
+    def handler(request):
+        calls.append(request)
+        return httpx.Response(200)
+
+    results = run_checks(fake_client(handler), "https://example.com", active=True)
+
+    [skipped] = [f for f in results["https://example.com"] if f.check == "rate_limit"]
+    assert skipped.level == Level.INFO
+    assert len(calls) < 20
+
+
+def test_no_active_test_unless_asked():
+    client = fake_client(lambda request: httpx.Response(200))
+
+    results = run_checks(client, "https://example.com", probe=True)
+
+    assert not any(f.check == "rate_limit" for f in results["https://example.com"])