model-dos

From README

Model Denial of Service Security Check (OWASP LLM04:2025) What this checks Protects against resource exhaustion caused by unbounded prompts, missing token caps, or absent rate limiting. Attackers can submit enormous or recursive inputs that inflate inference costs, saturate GPU/CPU, and deny service to legitimate users. Vulnerable patterns LLM API calls with no maxtokens parameter — model generates until its internal limit No input length validation before sending to the inference endpoint Multi-turn chat that accumulates context indefinitely across turns No per-user or per-IP rate limiting on the prompt endpoint Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties: Every LLM call sets an explicit output cap — the provider's max-tokens parameter or its equivalent. Leaving it at the provider default lets a single request run for minutes and rack up dollars in tokens.