Per-second rate limiting, and the burst it exposed

Laravel 11 allows a per-second limit, and applying one to an endpoint limited to sixty a minute showed what that had actually been permitting.

// before: 60 per minute
RateLimiter::for('api', fn ($r) => Limit::perMinute(60));

// which permits 60 requests in the first second and
// nothing for 59 seconds. one client did exactly that.

// after
RateLimiter::for('api', fn ($r) => [
    Limit::perSecond(5),
    Limit::perMinute(60),
]);

A per-minute limit is a burst allowance with a long refill, and a client doing its whole quota at once is behaving legitimately by the letter of the limit while producing a load pattern nobody sized for. Stacking two limits is the fix and it needs both — the per-second alone would permit three hundred a minute.