Hitlimit

A TypeScript monorepo of middleware, plugins and guards for API throttling, brute-force protection, tiered SaaS limits, abuse bans and distributed request counting. It ships 8 framework adapters (Express, Fastify, Hono, NestJS, Elysia and Bun.serve among them) and 8 pluggable storage backends: Redis-compatible stores, SQL databases, MongoDB, SQLite and process-local memory.

The hot path is synchronous, reuses result objects so nothing is allocated per check, and uses prepared statements, SQLite WAL mode and precomputed configuration flags. On 10K-key benchmarks it does more than 4M operations per second on Node.js and more than 5.5M on Bun.

Under concurrent traffic, atomic Redis Lua scripts and database upserts handle hit counting, violation tracking and auto-bans, cutting Redis ban evaluation from 3–4 round trips to 1 and removing the race between the ban check and the counter update.

Performance is guarded by a reproducible pipeline: 1, 1K and 10K-key workloads, five-run benchmarks with 250K measured operations per test, cross-runtime integration tests against Dockerized Redis, PostgreSQL, Valkey, DragonflyDB, MongoDB and MySQL, and automatic flags on any regression above 10%.