High

No rate limits

What it is

Endpoints that accept unlimited requests: login and OTP forms can be brute-forced, signup can be spammed, and AI endpoints can burn through your credits.

Why fast-built apps get it

Rate limiting isn't needed for a demo, so it's never generated. It only matters the day someone points a script at you.

Before and after the cure

app/api/otp/verify/route.tsVulnerable

export async function POST(req: Request) {
  const { phone, code } = await req.json();
  const ok = await db.otp.findFirst({ where: { phone, code } });
  // 6 digits, unlimited guesses: cracked in minutes
  return Response.json({ ok: !!ok });
}

app/api/otp/verify/route.tsCured

export async function POST(req: Request) {
  const { phone, code } = await req.json();
  const { success } = await limiter.limit(`otp:${phone}`); // 5 per 15 min
  if (!success) return new Response("Too many attempts", { status: 429 });
  const ok = await verifyOtp(phone, code); // expires after 5 minutes
  return Response.json({ ok });
}