09/06/2026
Every student on the platform was locked out. The error said "Too Many Requests." The client assumed their GitHub login had broken.
It hadn't. And neither had GitHub.
Here's what happened yesterday to one of our clients learning platforms. A wave of automated bot traffic was hammering the GitHub OAuth login endpoint. GitHub did exactly what it's designed to do and applied rate limits to that IP. The trouble is, once those limits tripped, real students got knocked back alongside the bots.
Our monitoring picked up thousands of malicious requests during the incident, from IP addresses across multiple countries. (geolocation shows where traffic appears to come from, not who's behind it. But it tells you how global and automated this stuff has become.)
We could have switched off GitHub login or added friction across the whole platform. Both punish your real users for a problem they didn't cause.
So we went targeted instead. A single Cloudflare Managed Challenge on the OAuth redirect. Real people pass a quick check and carry on. Bots get filtered out before they ever reach the authentication flow.
Result: access restored the same day. No changes to the client's app. No changes to their GitHub setup.
The lesson for anyone running an AI or tech platform: the best security fixes usually stop the bad traffic before it reaches the services you depend on.
Use the right rule, the right tools and in the right place, and you protect your users and your dependencies in one move.
Seeing rate limit errors at a third-party login? Don't assume the integration's broken. Check your IP's rate limit status first.
If you have a problem, if no one else can help, and if you can find them, maybe you can hire the A-Team! If not give us a call 😀
https://www.devstars.com/blog/githubs-too-many-requests-error/
hashtag hashtag hashtag hashtag hashtag hashtag
