Problem
POST /auth/login has no rate limiting. A brute-force attacker could try every password.
For a local-only tool this risk is lower, but a simple in-memory rate limiter on this endpoint would be good practice.
Suggested Fix
Add a basic in-memory rate limiter (e.g., max 5 attempts per 5 minutes per IP) on the login endpoint.
Problem
POST /auth/loginhas no rate limiting. A brute-force attacker could try every password.For a local-only tool this risk is lower, but a simple in-memory rate limiter on this endpoint would be good practice.
Suggested Fix
Add a basic in-memory rate limiter (e.g., max 5 attempts per 5 minutes per IP) on the login endpoint.