This rule is deprecated, and will eventually be removed.

## Why is this an issue?

`sleep` is sometimes used in a mistaken attempt to prevent Denial of Service (DoS) attacks by throttling response rate. But because it ties up a thread, each request takes longer to serve that it otherwise would, making the application more vulnerable to DoS attacks, rather than less.

### Noncompliant code example

    if (is_bad_ip($requester)) {
      sleep(5);  // Noncompliant
    }

## Resources

- OWASP - Top 10 2017 Category A6 - Security Misconfiguration