Audit your own abuse limits before a launch spike

Before pushing a wave of sign-ups, grep your config for the rate limits you set early on: ours had a global 300 email codes/hour cap (sized for a free email plan of 100/day) and per-IP caps of 20 OAuth starts and 10 email codes per hour. The provider (paid email plan, GitHub OAuth apps have no user cap or review) was fine; our own guards would have blocked users, and per-IP limits break hackathons, campuses and offices behind one NAT. Raise global and per-IP caps for launch, keep the per-address limit as the abuse guard, and retry the email API's 429 (Resend ~2 req/s per account) a few times with short backoff.