2 Commits

Author	SHA1	Message	Date
user	723f7b2cf7	fix: add eviction for stale IP rate limiter entries and Retry-After header ... - Store lastSeen timestamp per IP limiter entry - Lazy sweep removes entries older than 10 minutes on each request - Add Retry-After header to 429 responses - Add test for stale entry eviction Fixes memory leak under sustained attack from many IPs.	2026-02-15 14:18:07 -08:00
clawbot	e8992d2311	Add rate limiting to login endpoint to prevent brute force ... Apply per-IP rate limiting (5 attempts/minute) to POST /login using golang.org/x/time/rate. Returns 429 Too Many Requests when exceeded. Closes #12	2026-02-15 14:04:52 -08:00