# Binary evals (5) — max = 5 (1 stable query: IP rate-limiting best practices for Express)

E1 Key practices surfaced [FEATURE]: the load-bearing Do/Don't (trust-proxy exact count not true, default/ipKeyGenerator IPv6, shared store for multi-instance, standard headers).
E2 Pitfalls/gotchas surfaced [FEATURE]: trust-proxy=true spoofable, default-false global-bucket, MemoryStore-per-process, IPv6 rotation, X-Forwarded-For spoofing.
E3 No code blocks [BUDGET TARGET]: no fenced code blocks; patterns named inline (the example repo link is the pointer).
E4 Lean [TOKEN]: output ≤ 600 tokens (~450 words).
E5 Sources grounded [ACCURACY]: cited URLs are real/plausible official or reputable sources (not fabricated); confidence calibration (high vs context-dependent) retained.
