API Rate Limiting not triggering correctly

The documentation states a limit of 100 req/min, but I was able to send 500 requests without receiving a 429 Too Many Requests response. This is a security risk.