diff --git a/.env.example b/.env.example
index daebd2f..1016297 100644
--- a/.env.example
+++ b/.env.example
@@ -10,6 +10,14 @@ RATE_LIMIT_UPLOAD_BURST=15
 # Rate Limit — 图片访问限流（/uploads/*）
 RATE_LIMIT_IMAGE_PER_SEC=10
 RATE_LIMIT_IMAGE_BURST=50
+# Rate Limit — 评论限流（POST 评论）
+RATE_LIMIT_COMMENT_PER_SEC=1
+RATE_LIMIT_COMMENT_BURST=5
+# Rate Limit — 宽松桶：无法识别真实客户端 IP（"unknown"）时使用。
+# 当未配置可信代理（TRUSTED_PROXY_COUNT=0）时，Dioxus server function 拿不到 TCP
+# 对端地址，请求会落到这个桶，因此阈值更高以免误杀正常用户。
+RATE_LIMIT_UNKNOWN_PER_SEC=30
+RATE_LIMIT_UNKNOWN_BURST=100
 
 # Security
 # Trusted origin for CSRF checks on write requests (POST/PUT/PATCH/DELETE).
diff --git a/AGENTS.md b/AGENTS.md
index c8a48a8..0091512 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -41,6 +41,10 @@ RATE_LIMIT_UPLOAD_PER_SEC=2
 RATE_LIMIT_UPLOAD_BURST=15
 RATE_LIMIT_IMAGE_PER_SEC=10
 RATE_LIMIT_IMAGE_BURST=50
+RATE_LIMIT_COMMENT_PER_SEC=1          # comment posting
+RATE_LIMIT_COMMENT_BURST=5
+RATE_LIMIT_UNKNOWN_PER_SEC=30         # fallback bucket when real client IP can't be determined
+RATE_LIMIT_UNKNOWN_BURST=100
 DB_POOL_SIZE=20             # database connection pool size
 MIGRATE_STARTUP_TIMEOUT_SECS=30  # how long startup waits for PostgreSQL before giving up
 STATEMENT_TIMEOUT_SECS=30   # per-query timeout; slow queries are canceled to protect the pool