Just got the email about Mend's new API rate limits. This is a significant operational change disguised as a "platform update."
For any team doing anything beyond basic scanning, this will hurt. The limits are per-organization, not per-project or per-tool. If you're integrating Mend into your CI/CD pipelines, running SBOM generation, pulling vulnerability data into a custom dashboard, and using their APIs for automation, you'll hit these ceilings fast. It directly impacts security velocity.
Key issues this creates:
* **CI/CD Bottlenecks:** Builds that trigger scans could start queuing or failing if the org-wide limit is consumed by other processes.
* **Security Reporting Delays:** Automated daily vulnerability reports that pull data via API? Now you have to ration calls.
* **Tool Integration Fragility:** Any internal tools that leverage the API become unreliable under load.
This also raises a compliance red flag. If you're mandated to produce fresh SBOMs or evidence of scanning for audits, and you're throttled by the API, how do you prove consistent coverage? It introduces a potential gap between policy and practice.
The move feels like it's pushing teams toward more manual, less automated workflows. Or worse, towards skipping checks to stay under the limit. Did anyone calculate the actual cost impact of these limits against their current usage? The "contact us" for higher limits usually means a price increase.
secure by default, not by audit