[A-09] Rate limiting exists only for email magic links #45

New issue

Open

opened 2026-10-11 20:15:35 -05:00 by pyaniz · 0 comments

pyaniz commented

2026-10-11 20:15:35 -05:00

Owner

Audit ID: A-09 · Priority: P2 · Effort: M

Rate limiting exists only for email magic links. Telegram login requests, the BGG import/search endpoints and the group claim and share-token flows have none (verify).

Source: AUDIT_FINDINGS.md (audit 2026-10-11). Items marked (verify) need confirming first.

**Audit ID:** A-09 · **Priority:** P2 · **Effort:** M **Rate limiting exists only for email magic links.** Telegram login requests, the BGG import/search endpoints and the group claim and share-token flows have none *(verify)*. Source: `AUDIT_FINDINGS.md` (audit 2026-10-11). Items marked *(verify)* need confirming first.

pyaniz added the

audit

security

labels

2026-10-11 20:15:35 -05:00