Loading canvas…

Not ship-ready2 blockers (critical/high)

CriticalNo rate limiting on the auth path

security · API Gateway → Auth Service

The gateway forwards token checks to the auth service with no per-IP rate limit. Credential-stuffing and token-brute-force attempts hit it unthrottled.

Why flagged: Gateway → Auth edge with no limiter node or policy between them.

Fix: Add a rate limit (e.g. 10 req/s per IP) at the gateway in front of the auth route, with exponential backoff on repeated failures.

HighAll reads hit the primary database

bottleneck · PostgreSQL

Every API read and write goes to a single Postgres primary. Under load, read traffic starves writes and tail latency climbs.

Why flagged: Single database node fanned into by the API with no replica.

Fix: Add a read replica and route read-only queries to it, or cache hot reads in Redis (already present).

MediumSynchronous LLM calls block request threads

scalability · API Server → LLM Provider

The API awaits the LLM completion inline. A slow model response holds a worker thread the whole time, capping concurrency well below CPU limits.

Why flagged: API → LLM edge over a request-scoped HTTP call.

Fix: Stream the completion and free the thread, or move long generations onto a queue and return a job id.

LowCache is a single point of failure for sessions

reliability · Redis

Sessions live only in Redis. If it restarts, every user is logged out at once.

Fix: Run Redis with persistence or a replica, or fall back to verifying the token against auth on a cache miss.

InfoLLM spend will dominate the bill

cost · Whole system

With LLM calls on the hot path, model tokens — not infrastructure — will be the largest line item as usage grows.

Fix: Cache common completions and use a smaller model for cheap intents to keep spend sub-linear to traffic.