​
Limits & Quotas

Golem AI enforces limits to ensure platform stability and prevent runaway costs.

​
Audit time budgets

Each mode has a fixed task budget; the agent is force-stopped before the wall-clock expires so reporting always completes: Even when a run hits its budget, you receive everything confirmed before the cutoff — the audit completes with a coverage summary showing what was and wasn’t finished.

​
API rate limits

Sensitive endpoints are rate-limited per client to prevent abuse:
  • Verification attempts (app drafts and apps): 6 per minute
  • Mobile store lookups: 30 per minute
  • API key operations: low per-minute caps
Standard automated-client practice applies: back off on 429 responses and honor Retry-After headers.

​
Plan caps

Exceeding an app or asset limit returns a clear error on the create/update call.

​
Report URL TTL

Presigned report URLs from the API expire after 10 minutes — re-request if you need a fresh link.

​
Target restrictions

Golem AI does not allow auditing arbitrary domains: every app must pass ownership verification (meta tag or DNS TXT for web; store metadata + attestation for mobile) before any audit runs, and launching an audit requires accepting the authorized-testing terms.
Running unauthorized audits is illegal in most jurisdictions. Every audit is logged with target, timestamp, and the API key that initiated it.

​
Increasing limits

For custom limits or enterprise arrangements, contact us via Discord.