Solutions Architect, Application Security
Phil Lu
Works on automated traffic identification and API abuse in AI products — separating bots from real users, quota and cost control for generative endpoints (image and video), and engineering behavioural signals at the edge.
Areas of focus
- Telling bots from real users
- AI agent and automated call governance
- Abuse and cost control for generative endpoints
- Behavioural signal engineering
Articles (5)
Rate Limiting AI APIs: Keys, Thresholds and False Positives
A rate limit is four decisions: what matches, what you count by, over what period, and what happens next. AI endpoints get the second one wrong.
Securing APIs and Tool Calls in AI Agent Systems
Agents turn data access into autonomous action, and classic API defences break. Least privilege, two-way validation and replayable audit trails.
How to Protect AI Image Generation APIs from Abuse
Image endpoints are costly and queue-sensitive: a few abusive callers fill the GPU queue. Rate limit by compute units, not request count.
How to Protect AI Video Platforms from Bots and Scrapers
Video hotlinking, catalogue scraping and fake engagement drain CDN budget. Signed URLs, player endpoints, bot fingerprinting and cost governance.
How to Distinguish Legitimate Users from Malicious Bots
Bots are not automatically bad. Evidence across credential, environment and behaviour layers, real bot score semantics and a response ladder.