Use this skill whenever building any public API endpoint, a signup or login flow, a contact form, or any feature that calls a paid third-party API (especially an AI/LLM API) on a user's behalf. Also use it when a user asks to "add an AI feature," "let users generate content," "add a free tier," or "add a contact form," and whenever reviewing an application for abuse resistance before launch. The default failure modes this prevents: unlimited requests draining a paid API budget, scripted bots farming free-tier signups for unlimited usage, and public endpoints with no rate limit being trivially hammered or scraped.
