The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Your API doesn't need to be hacked to become expensive.
If a bot can hit an expensive endpoint 50,000 times, you could end up paying for the damage even though your authentication is working perfectly.
I see SaaS teams put a lot of effort into protecting passwords and auth tokens, while overlooking things like rate abuse, brute-force requests, and automated scraping.
For a Laravel + Vue application, these are some of the things I'd put in place:
Rate-limit the expensive stuff
Don't use the same limit for every endpoint.
A search endpoint might allow 60 requests/minute, while an endpoint that generates PDFs or triggers an AI workflow should have a much tighter limit.
Laravel's RateLimiter makes it easy to define limits based on the user, route, subscription, or other conditions.
For example:
Free users: 30 requests/minute
Paid users: 200 requests/minute
Expensive AI/PDF operations: much stricter limits
Redis is a good choice when you're running multiple application servers.
Protect SPA authentication properly
If your Vue frontend talks to Laravel through Axios or Inertia, Laravel Sanctum's cookie-based authentication is usually a better fit than storing JWTs in localStorage.
Sanctum + Laravel's CSRF protection gives you a solid foundation for browser-based authentication without having to build your own token storage system.
Don't return your Eloquent models blindly
This:
return $user;
might work, but it can also expose fields that your frontend never needed.
Use API Resources to explicitly control what gets returned:
return new UserResource($user);
That makes your API response intentional and reduces the chance of accidentally exposing internal fields.
Validate everything coming from the client
Don't trust request payloads just because they came from your own Vue application.
Use Form Requests to handle validation before your business logic runs.
Validate things like:
UUIDs
maximum lengths
allowed values
required fields
numeric ranges
file types and sizes
Your frontend validation is for user experience. Your backend validation is for security and correctness.
The important part is that API security isn't just about authentication.
It's also about controlling what can be called, how often it can be called, what data can be returned, and what the server is allowed to process.
If you're building a Laravel web application, these are things worth thinking about before the API starts getting real traffic.
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
Build-in-public: this week I changed how my SaaS charges. Shakehand used to limit how many email accounts you could connect, now you can connect as many as you want and you pay for the emails you send. The limit was charging people for the wrong thing, they were paying for seats while the value was in the sending. Lesson I keep re-learning: if customers keep hitting a limit that has nothing to do with the outcome they want, the limit is the product problem, not the customer. Remove it and price the thing they actually came for.
The open padlock with paper planes flying out of the envelope says it in one glance. Did people connect more accounts after you removed the cap?
The 3-Step Scope Framework That Stopped Scope Creep & Boosted Project Values
When I started freelance web design and development, scope creep was the silent killer of profitability. Projects scheduled for two weeks turned into two-month sagas, and additional requests came in without budget adjustments.
Here is how I redesigned my project workflow to protect boundaries while delivering higher value for clients:
Deliverable-Based Scoping (Not Hourly): Instead of listing hours, every proposal outlines exact outputs (e.g., custom animations, responsive layouts, specific page counts). If it's not on the list, it’s a phase-two add-on.
Asynchronous Client Reviews: To keep momentum high, I replace long status meetings with loom walk-throughs and clear review deadlines. Clients love the efficiency, and it speeds up delivery timelines by 40%.
Built-in Buffer & Optimization Sprints: I allocate the final 15% of every contract purely for testing, performance optimization, and handoff docs. Handoffs feel seamless, and clients get a fully polished asset ready to convert.
Standardizing this process not only improved client satisfaction but also double my average project value.
What’s the single biggest operational change you’ve made in your freelancing process this year? Drop your thoughts below! 👇
Appreciate the practical advice on scope.
SaaS MVP Scope & Cost Estimator | Lead Qualification & Intake System
The Challenge: Early-stage SaaS founders and product agencies often waste weeks navigating manual inquiry cycles and discovery calls just to map out MVP requirements and sprint budgets.
The Solution: I designed and built an interactive MVP Scoping Engine. This system enables founders to select required platform features—such as multi-tenant authentication, recurring subscription billing, AI API integrations, and admin role permissions—and receive real-time cost and timeline estimates instantly.
Key Features:
Dynamic real-time pricing and sprint timeline calculator
Categorized feature selector (Auth, Core Plumbing, AI, Admin Ops)
Automated MVP Production Brief generation for instant lead qualification
Turning the first discovery call into a 60 second flow is a smart idea. In my experience founders tend to tick every feature so the estimate jumps. A short note next to each option on how it changes the timeline could keep the scope realistic. How close have the price ranges been to real quotes so far?