Scan rule · RSC-SEC-026
Sign-in without a detectable limit
SecuritySeverity: MediumCWE-307OWASP A07-2021
After ownership proof, sends a small series of failing sign-in attempts and checks whether anything throttles.
Scan tier
Active (after domain proof)
How to fix it
Add rate limiting per IP and per account, then a delay or captcha.