AWS API Gateway default: 10,000 requests per second, shared across all APIs in your region. One user floods a single health check endpoint, exhausts your entire quota. No per-method isolation. One careless endpoint configuration becomes an account-wide vulnerability.