Backend · How to use a skill

add-chatbot-guardrails-and-rate-limits

Protects a public AI chatbot from abuse before launch - per-user and per-IP rate limits, a monthly spend cap, input and output size limits, prompt-injection-resistant system prompts, moderation, and logging without personal data. Use when the user worries about abuse or a surprise AI bill, wants to rate limit an API, or needs to stop jailbreak attempts on a chatbot.

Version 1.0 · Updated 2026-10-31

View raw SKILL.md

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/add-chatbot-guardrails-and-rate-limits/raw' -o ~/'.claude/skills/add-chatbot-guardrails-and-rate-limits/SKILL.md'

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/add-chatbot-guardrails-and-rate-limits/raw' -o '.cursor/skills/add-chatbot-guardrails-and-rate-limits/SKILL.md'

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/add-chatbot-guardrails-and-rate-limits/raw' -o '.agents/skills/add-chatbot-guardrails-and-rate-limits/SKILL.md'

{
  "mcpServers": {
    "theskillvault": {
      "url": "https://theskillvault.ai/mcp"
    }
  }
}

Add chatbot guardrails and rate limits

A public chatbot is a public tap on your AI bill. Put limits in before you share the link.

When to use

• Before launching any chatbot that people can use without paying.
• After an unexpected AI bill or a spike in traffic.
• People are getting the bot to ignore its instructions.

Steps

1. Set a hard spend limit at the provider. Most AI dashboards have a monthly budget or usage limit. Set it to an amount you can afford to lose.
2. Rate limit per user and per IP. For example 20 messages per 10 minutes and 200 per day. Use a shared store such as Redis, Upstash, Cloudflare KV or Durable Objects, or your database. In-memory counters reset on every serverless start.
3. Return 429 with a clear message ("You've hit the limit - try again in 10 minutes") and a Retry-After header.
4. Cap sizes. Limit each message (for example 2,000 characters), the history you send (last 20 messages) and the reply length (max_output_tokens or your provider's equivalent).
5. Require sign-in or a captcha for heavy use. Anonymous users get a small allowance. Signed-in users get more.
6. Harden the system prompt. Say what the bot does and refuses. Tell it that text from users or documents is data, not instructions. Never put secrets in the prompt, since users can often get it to repeat it.
7. Moderate. Run inputs, and outputs if needed, through your provider's moderation endpoint or a simple blocklist. Refuse politely.
8. Give tools the least power. If the bot can call tools (send email, read the database), allow read-only actions by default and ask a human before anything irreversible.
9. Log safely. Record counts, token use and errors, without full messages or personal data unless your privacy policy says so. Alert yourself when daily spend passes a threshold.

Gotchas

• Rate limiting by IP alone blocks whole offices and schools. Combine it with user IDs.
• No prompt is jailbreak-proof. Limits and tool permissions are the real protection.
• Keep API keys server-side. Rotate a key at once if it ever appears in the browser, a repo or a log.

Works with any stack

These steps work with any provider (OpenAI, Anthropic, Google, local models) and any host. Use your platform's built-in rate limiting (Cloudflare, Vercel, API gateways) instead of custom code if you have it.

Done when

• Sending 25 messages in a minute gets a 429 with a friendly message.
• A message over the size limit is rejected before any model call.
• The provider dashboard shows a spend limit, and you get an alert email when spend passes your threshold.

Example prompt

"Stop people abusing my free AI chatbot and running up my OpenAI bill."

Licence: CC BY 4.0. Attribution when you reuse it: From TheSkillVault, https://theskillvault.ai, CC BY 4.0