Are we also rate limiting how many vulnerabilities malicious actors can find?