  Unauthorized light injection has always been a vital threat to the practical
security of a quantum key distribution (QKD) system. An optical power limiter
(OPL) based on the thermo-optical defocusing effect has been proposed and
implemented, limiting the injected hacking light. As a hardware countermeasure,
the performance of the OPL under various light-injection attacks shall be
tested to clarify the security boundary before being widely deployed. To
investigate the OPL's security boundary in quantum cryptography, we
comprehensively test and analyse the behavior of OPL under continuous-wave
(c.w.) light-injection attacks and pulse illumination attacks with pulses'
repetition rate at $0.5$-$\hertz$, $40$-$\mega\hertz$, and $1$-$\giga\hertz$.
The testing results illuminate the security boundary of the OPL, which allows
one to properly employ the OPL in the use cases. The methodology of testing and
analysis proposed here is applicable to other power-limitation components in a
QKD system.
