Sign-in without a detectable limit
Scan rule · RSC-SEC-026
- Security
- Severity: Medium
- CWE-307
- OWASP A07-2021
After ownership proof, sends a small series of failing sign-in attempts and checks whether anything throttles.
Scan tier
- Active (after domain proof)
How to fix it
Add rate limiting per IP and per account, then a delay or captcha.