How a subtle race condition in file-based rate limiting allowed unlimited API calls, and the atomic operations that fixed it.