Starting October 19, 2026, GitLab.com caps requests by subscription — 60 per hour per anonymous IP, 5,000/hour on Free, up to 25,000/hour on Ultimate — to absorb load from AI agents and automation. Authenticate your scripts and agents, and check your peaks before the October 7 and 14 brownout windows.

Vaultwarden 1.37.3, released on September 13, 2026, adds rate limiting to the pre-login and auth request endpoints and revokes 2FA remember tokens when credentials change. For a self-hoster, it is a security update to apply without delay.

Your APIs aren’t internal plumbing anymore — they’re your products. An API Gateway centralizes the rate limiting, authentication, caching, and analytics that every microservice would otherwise have to reinvent in its own code. Kong, Traefik, and Tyk embody three distinct architectures: here’s how to pick the one that won’t slow you down.