mediumConfiguration

Missing Rate Limiting

Your application has auth routes but no rate limiting.

Why it matters

Without rate limiting, attackers can make unlimited login attempts per second, enabling brute-force attacks on user passwords. They can also overwhelm your server with requests (DoS). Rate limiting is essential for any public-facing endpoint.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Auth routes without rate limiting
const express = require('express');
const app = express();
app.post('/login', (req, res) => {
  res.json({ token: 'abc' });
});
app.post('/register', (req, res) => {
  res.json({ ok: true });
});

The smallest fix

minimal patch
// Add express-rate-limit:
import rateLimit from 'express-rate-limit';
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
});
app.use('/api', limiter);

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The file [the file] has auth routes but no rate limiting. Add rate limiting middleware, especially to login and registration endpoints.

How to check the fix worked

1. Send 101 requests in 15 minutes — expect 429 on the 101st
2. Wait for the window to reset — expect requests to succeed again
3. Verify rate limit headers in responses

Further reading