I would take the 18k for a brute force attack dude… that’s more than fair. People tend to already know when you can brute force stuff.

> Rate limiting would be performed in the Apple server itself or in HSM (hardware security module). Either way, the rate limit logic should be programmed as such to prevent race hazard. There is very bleak chance for this endpoint to be not vulnerable to race hazard before my report because all the other endpoints I tested was vulnerable

The HSMs they’re using at Apple aren’t patchable… that’s kinda the point. Sorry.