diff --git a/.gitignore b/.gitignore
index 0a3503e..3baf4fd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -85,3 +85,6 @@ REALITY_MIGRATION_PLAN.md
 xray_config_reality.json
 SERVER_DEPLOYMENT.md
 swarm_watch.py
+nginx_hivemind_reality.conf
+nginx_hivemind_reality.conf
+nginx_hivemind_reality.conf
diff --git a/nginx_hivemind_reality.conf b/nginx_hivemind_reality.conf
index 1cd1431..d70c424 100644
--- a/nginx_hivemind_reality.conf
+++ b/nginx_hivemind_reality.conf
@@ -6,6 +6,11 @@
 #   - Xray Reality handles the VPN tunnel directly on port 8443
 #   - nginx only serves the API (proxied to Flask) and any static website
 
+# ── Rate limiting (uncomment when you need it) ───────────────────────────
+# Defines a 10MB shared memory zone tracking request rate per IP.
+# 10 r/s with burst of 20 — anything above gets HTTP 503.
+# limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
+
 server {
     listen 443 ssl http2;
     server_name getrevolt.app;  # ◄── CHANGE ME to your domain
@@ -41,6 +46,8 @@ server {
 
     # ── API proxy to Hivemind (Flask) ────────────────────────────────────
     location /api/ {
+        # Rate limiting — uncomment when you uncomment limit_req_zone above.
+        # limit_req zone=api_limit burst=20 nodelay;
         proxy_pass http://127.0.0.1:5000;
         proxy_http_version 1.1;
         proxy_set_header Host $host;