diff --git a/api/get_users.php b/api/get_users.php
index 77e0afd..5971ee3 100644
--- a/api/get_users.php
+++ b/api/get_users.php
@@ -8,8 +8,10 @@
 require_once __DIR__ . '/bootstrap.php';
 
 try {
-    // Get all users for mentions/assignment
-    $result = Database::query("SELECT user_id, username, display_name FROM users ORDER BY display_name, username");
+    // Get all users for mentions/assignment. Capped as defense-in-depth against
+    // a single call scraping an unbounded user list — every caller only needs
+    // this for typeahead/dropdown filtering, never a literal full roster.
+    $result = Database::query("SELECT user_id, username, display_name FROM users ORDER BY display_name, username LIMIT 500");
 
     if (!$result) {
         throw new Exception("Failed to query users");