Bug: /health /ready /metrics are rate-limited in prod despite docs claiming exempt-by-default

[Alimedhat000]

Summary

Docs claim /health, /ready, /metrics are exempt from global rate limiting by default, but the code default is an empty exempt set — so in prod these paths ARE rate-limited.

Evidence

• docker/.env.example:54: RATE_LIMIT_EXEMPT_PATHS=/health,/ready,/metrics
• docker/README.md ("Health/readiness/metrics request logs are skipped by default via LOG_SILENT_PATHS" and the rate-limit table): states these paths are excluded from limiting
• config.py:69-73:

  RATE_LIMIT_EXEMPT_PATHS = {
      p.strip()
      for p in os.environ.get("RATE_LIMIT_EXEMPT_PATHS", "").split(",")
      if p.strip()
  }

  With no env var set, this is set().
• The deployed docker/.env.docker does not set RATE_LIMIT_EXEMPT_PATHS.

So nginx healthchecks, Prometheus scrapes of /metrics, and readiness probes all consume the 120/min per-IP budget (app.py global_rate_limit runs before route matching, including on these paths).

Suggested fix

Make the default match the docs, either:

• in config.py: default RATE_LIMIT_EXEMPT_PATHS to {"/health", "/ready", "/metrics"} when the env var is unset, or
• add RATE_LIMIT_EXEMPT_PATHS to docker/.env.docker / the deploy env.

Then pick one source of truth (code default vs env) and update the docs to match.