Source code Security & compliance Cost Stability

No rate limit on public POST

Part of the Production readiness check · fix arrives as a guide

What it is

A public POST endpoint — login, signup, password reset, contact form, or a paid API call — has no rate limit in front of it.

Why it matters

Credential stuffing and enumeration look like ordinary traffic without one. On endpoints that cost money per call, an unthrottled loop is a bill, and on a signup endpoint it is a database full of junk.

How to fix it

Rate-limit by IP and by account with a shared store so the limit holds across instances. Apply stricter limits to authentication endpoints and add exponential lockout after repeated failures for one identity.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.