Public endpoints overwhelmed by abusive traffic
Signed-out users experienced 504 errors (peaking at 34% error rate) for pull requests, issues, and releases across GitHub.com for two hours; authenticated users were unaffected.
Isolate unauthenticated traffic to separate backend resources or rate-limit public endpoints independently to prevent malicious traffic surges from degrading service for authenticated users.
A significant surge in abusive traffic targeting specific GitHub.com endpoints used by unauthenticated users.
Abusive traffic to public endpoints overwhelmed request processing capacity, causing legitimate requests to queue beyond timeout thresholds and return gateway timeout errors, degrading service availability for signed-out users across multiple GitHub services.
How would you architect public and private request paths to ensure that a traffic surge targeting public endpoints cannot degrade service for authenticated users?
