To stop bots from buying out a limited drop, decide which step is scarce, cap it per verified account, slow down automated flows, and add human checks in proportion to the damage. OWASP lists this as unrestricted access to sensitive business flows, where the harm is business impact rather than a technical break-in.
Name the flow you are protecting
Not every endpoint needs a bot defense. Ask which flow causes real harm if scripted: buying scarce items, claiming rewards, redeeming codes, creating accounts for referral credit, or booking a limited event slot.
OWASP's guidance for this risk starts the same way. Identify the flows that would hurt the business if used excessively, then apply protections that fit. A free cosmetic needs less than a drop that resellers will target.
Controls, from cheap to heavy
- Per-account and per-payment-method purchase caps. Cheap and effective against hoarding.
- Rate limits by account, device and network, set stricter on the sensitive flow than elsewhere.
- Flow timing checks. A human cannot add to cart and pay within a second, as the OWASP page notes, so flag unnaturally fast sequences.
- Device checks to reject unexpected clients such as headless browsers.
- Human verification such as a CAPTCHA, used at the point of risk and not on every page.
- A queue or lottery for the highest demand moments, so speed stops being the winning strategy.
Blocking known anonymizing networks is another option OWASP mentions. Weigh it against legitimate players who use privacy tools.
Do not forget the machine-facing doors
Mobile endpoints, partner APIs and internal tools often bypass the web protections. A bot that cannot beat the website will try the API the app uses. Apply the same limits to every client path.
Plan for resale and account trading
If items can be traded, scarcity can leak after purchase. Consider trade holds on newly bought limited items, and watch for accounts that buy and instantly transfer. Say so in your terms, so enforcement is clear.
Launch day checklist
- List the flows to protect and the maximum a normal player does in a minute.
- Set caps and rate limits below what a script needs.
- Load test with a script that behaves like a bot, not only like a crowd.
- Prepare a switch that tightens limits or moves to a queue during the event.
- Log purchases with account, device and network fields so you can reverse abuse afterward.
Try it yourself
Open the demo and run the API scan. Look at how endpoints are listed and which ones accept requests without strong controls.
Click through it at your own pace, or open it full screen.
Safeguard offers API scanning and dependency scanning that can help you find exposed endpoints before launch. There is a free scan at https://gold.safeguard.sh/scan.
Quick check
Is a CAPTCHA enough?
No. It is one layer. Caps, timing checks and account level limits matter just as much.
Should I rate limit every endpoint the same?
No. Set stricter limits on flows where automation causes harm, and looser ones on ordinary reads.
Sources
Last reviewed: 19 October 2026.
