Checks · AUTH-005

AUTH-005 · Missing rate limit on login, signup or OTP

Why it matters

Without a limit, a script can guess passwords or flood one-time codes.

How we detect it

Auth routes have no limiter.

How we fix it

Add a limiter suited to the stack.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles