How many times can an attacker try to guess an ID before I detect?
Updated
Short answer
Without rate limit + monitoring: thousands. With basic monitoring (Sentry / equivalent): hundreds. With per-IP rate limit: 10s. Add monitoring + rate-limit + Securie continuous-scan.
Default Vercel + Next.js apps have no rate limit + no monitoring on enumeration patterns. Attackers iterate freely.
Defense: per-IP rate limit at edge (Upstash / Cloudflare) + per-user rate limit (more restrictive) + Sentry-class anomaly detection on 4xx burst patterns.