security: bound attacker-controlled scan fan-out and rate-limit write race

security: bound attacker-controlled scan fan-out and rate-limit write race #834