Help me test the beta (dry-run can’t block anyone)

[hanzala-afzal-dev]

Hi everyone 👋

I'm Hanzala, and I built Dynamic Throttle because I kept hitting the same wall. In Laravel, rate limits live in code. So when a partner suddenly starts getting 429s, or a bot hammers /login at 2 a.m., the fix is an edit, a pull request and a deploy. And even then, you still can't really see who is being blocked.

Dynamic Throttle keeps your limits in the database instead. You change them from a dashboard, from Artisan or from code, and every server picks up the change within a couple of seconds.

It's in beta right now (0.1.0-beta.2). Before I call it stable, I need people who aren't me to run it on real apps. That's where you come in.

The safe way to try it

Every new rule starts in dry-run. A dry-run rule counts requests and shows you who it would have blocked, but it never blocks anyone. So you can point it at real traffic without risking a single wrong 429. If you'd rather start in staging, that's great too.

Setup (about 10 minutes)

composer require hanzala-afzal/laravel-dynamic-throttle:^0.1@beta
php artisan vendor:publish --tag=dynamic-throttle-migrations
php artisan migrate
php artisan dynamic-throttle:compile

Then attach the middleware to the routes you want it to watch, in bootstrap/app.php:

->withMiddleware(function (Middleware $middleware) {
    $middleware->appendToGroup('api', 'dynamic.throttle');
})

Keep Laravel's scheduler running, because it saves the traffic numbers the dashboard shows. The dashboard lives at /dynamic-throttle. Outside your local environment, you'll need to define a gate first: here's how.

Three things I'd love you to try

1. Add one rule in dry-run on a real route. In the dashboard, go to Rules → New rule. The "Login" and "API per user" templates are a good place to start.
2. Leave it alone for a day, then have a look. The Overview page shows what each rule saw and what it would have blocked. The Activity page shows who, with the IP and the user. (The live feed needs Redis or Valkey.) Does it match what you expected?
3. Run the health check: php artisan dynamic-throttle:health. It looks for setup mistakes. Did it catch something real, or complain about something that's actually fine?

If you're feeling brave, promote the rule from dry-run to enforcing, or try an emergency switch like php artisan dynamic-throttle:bypass on --for=10m. It turns itself off when the time is up.

What to tell me

Reply below, or open an issue if it's clearly a bug. Include:

• your Laravel and PHP versions
• where your counters live: Redis, Valkey, Memcached or the database
• how you run PHP: PHP-FPM, Octane, Vapor or something else
• what broke, what confused you, and what you expected instead

"It just worked" is useful to hear too. If something looks like a security problem, please don't post it here. SECURITY.md explains how to report it privately.

Thanks for giving it a go. I read every reply.

Hanzala