vetkit.llm-app.llm-call-without-token-limit
A model call driven by request input sets no output token limit. Each request can generate up to the model's maximum output, so a user (or a script) can drive cost and latency up with a single prompt.
Last updated:
Suite: AI code risks
javascript, typescript
A model call driven by request input sets no output token limit. Each request can generate up to the model's maximum output, so a user (or a script) can drive cost and latency up with a single prompt.
Category: LLM SECURITY · Engine rule severity: INFO
How to fix it
Set an explicit output limit (max_tokens / max_completion_tokens, max_output_tokens for the Responses API, maxOutputTokens / maxTokens in the AI SDK) sized for the feature, and rate-limit the endpoint per user.
References
Source: packages/engine/rules/llm-app/javascript.yml.
python
A model call driven by request input sets no output token limit. Each request can generate up to the model's maximum output, so a user (or a script) can drive cost and latency up with a single prompt.
Category: LLM SECURITY · Engine rule severity: INFO
How to fix it
Set an explicit output limit (max_tokens / max_completion_tokens, max_output_tokens for the Responses API) sized for the feature, and rate-limit the endpoint per user.
References
Source: packages/engine/rules/llm-app/python.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.