Back to Common risks

Common risksLogin and accounts

Login routes with no rate limit

AI scaffolds often ship bcrypt and JWT sign-in with no throttle in front of them. Unlimited attempts mean brute-force and sign-up spam can run as fast as the network allows.

What can go wrong

If the login handler runs a bcrypt compare or signs a JWT with nothing counting attempts before it, an attacker can try passwords at wire speed, spray sign-ups, or hammer the forgot-password flow to spam your email quota. Paired with distinct login error messages, the same loop first harvests which addresses exist, then guesses their passwords.

How to check yours

Seatbelt flags this automatically (partial). Repo read puts a rate-limit line on the agent checklist when auth-shaped routes exist with no project-wide limiter in sight; URL read soft-flags auth endpoints on the wire with no throttle signals. A checklist line means confirm it yourself, not that a limiter is missing for certain.

Honest holes: limits enforced at the edge (Cloudflare rules, a WAF, platform middleware outside the repo) are invisible to a static read and will look missing when they are not.

Ask your agent: "Open every login, register, and forgot-password route. Does a rate limiter run before the credential check in each one?"

Manual check: open each auth handler (or app/api/auth/), and search the file and middleware.ts for rateLimit, @upstash/ratelimit, express-rate-limit, or an edge limiter. If bcrypt compare or JWT sign runs with no throttle before it, the route is open to the loop.

Fix direction

Put a limiter in front of credential checks on login, register, and forgot-password, whether in the handler, shared middleware, or an edge rule.

Paste into your agent: "Add rate limiting before credential checks on every auth route: login, register, and forgot-password. Use Upstash Ratelimit, express-rate-limit, or an edge rule, and return 429 when the limit is hit."

Related risks

withseatbelt-risk-login-without-rate-limit

# product
name      Seatbelt
tagline   Seatbelt reads the code agents ship, and publishes what it finds
what      A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method    Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings  /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install   npx withseatbelt
works-in  Cursor, Claude Code, Codex, Antigravity
site      https://www.withseatbelt.com
contact   hello@withseatbelt.com

# current-page
path         /risks/login-without-rate-limit
title        Login routes with no rate limit · Seatbelt risk reference
description  bcrypt and JWT sign-in with no throttle in front: brute-force and sign-up spam at wire speed.

# risk
slug      login-without-rate-limit
title     Login routes with no rate limit
summary   bcrypt and JWT sign-in with no throttle in front: brute-force and sign-up spam at wire speed.
surface   Login and accounts
coverage  partial (whether the Seatbelt scan gates on this risk)
verified  2026-08-16
related   /risks/auth-account-enumeration, /risks/jwt-never-expires, /risks/client-only-paywall
note      The full entry text is the human view of this page.

# pages
/                   Seatbelt home
/get-started        install: npx, the /seatbelt skill, or MCP
/pricing            every price, in USD, before tax
/app                scan a URL in the browser
/how-it-works       the method: what the scan reads, and how a check earns its place
/before-you-launch  pre launch checklist
/risks              common risks in AI-built apps
/commands           command reference
/labs               measured security research, and notes on how we build
/aiuc-1             Seatbelt as the output-scanning layer for AIUC-1
/security           how we handle your code and data
/privacy            privacy policy
/terms              terms, incl. what a clear report does and does not claim
/refund             refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
  deterministic, so a published number can be re-run without asking us.