They seem to have documented it a while back.
- API and website: 10 requests per second
- Dependency API: 15 requests per second
- Website sign up, sign in, api key, and forgot password: 100 requests per 10 minutes
Users who hit a rate limit will see HTTP 429 responses, for the remainder of the limit window. Usually this is just a few minutes.