Source code
Security & compliance
Cost
Stability
No rate limit on public POST
Part of the Production readiness check · fix arrives as a guide
What it is
A public POST endpoint — login, signup, password reset, contact form, or a paid API call — has no rate limit in front of it.
Why it matters
Credential stuffing and enumeration look like ordinary traffic without one. On endpoints that cost money per call, an unthrottled loop is a bill, and on a signup endpoint it is a database full of junk.
How to fix it
Rate-limit by IP and by account with a shared store so the limit holds across instances. Apply stricter limits to authentication endpoints and add exponential lockout after repeated failures for one identity.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.