FD-2026-004 — GitHub secondary rate limit

Anatomy

GitHub's secondary rate limit punishes concurrency and content-cost, not request count. It returns 403 Forbidden — not 429 — with a Retry-After and a body naming the secondary limit. Clients that only special-case 429 retry immediately and make the ban longer.

Source: GitHub REST API docs — secondary rate limits

Replay it

curl -i https://faultydata.com/r/FD-2026-004

// response appears here

Signature

{Status:403 Headers:map[Retry-After:60 X-RateLimit-Remaining:0] Body:{"message":"You have exceeded a secondary rate limit. Please wait a few minutes before you try again.","documentation_url":"https://docs.github.com/en/rest/overview/resources-in-the-rest-api#secondary-rate-limits"} Corrupt: Delay:<nil> Flaky:<nil> Sequence:<nil> Drip:<nil> StallAfter:0 Hang:false Phases:[]}