Public write action with abuse protection
Scan rule · RSC-SEC-102
- Security
- Severity: Low
- CWE-799
Finds server actions and route handlers that write to the database without sign-in but rate-limit calls and validate input first — intentionally public forms.
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Nothing mandatory. Check that the action is meant to be reachable without sign-in and that the rate limit applies per sender.