...
Rate tracking requires rack-attack to have a working cache, which we don’t normally have in development – and we also need to enable the bot detect controls which are off by default.
set env CF_TURNSTILE_ENABLED=true to use Memory cache (resets on app restart) and enable protection in dev.
so rate gate to issue challenge will never be met! To test in development, you will want something like config.cache_store = :memory_store in your ./config/development.rb
...