Checks · AVL-004

AVL-004 · Unbounded AI spend

Why it matters

An AI route with no per-user limit can run up a large bill from one loop or one visitor.

How we detect it

An AI SDK call in a route has no quota and no max token setting.

How we fix it

Add a per-user quota and a max token cap.

Can it be fixed automatically? Yes, with a template change

Related checks

• DB-006 · No backups or point-in-time recovery
• DB-007 · Backups never restore-tested
• TLS-001 · Certificate expires in under 14 days
• TLS-002 · TLS below 1.2 accepted