Unlimited brute-force attempts possible on the login endpoint.
Suggested fix: Add per-IP rate limiter on /login POST. Consider exponential backoff or account lockout after N failed attempts.
## From Security Audit ([#33 comment](https://git.eeqj.de/sneak/webhooker/issues/33#issuecomment-10915))
**Severity: BLOCKER**
Unlimited brute-force attempts possible on the login endpoint.
**Suggested fix:** Add per-IP rate limiter on `/login` POST. Consider exponential backoff or account lockout after N failed attempts.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From Security Audit (#33 comment)
Severity: BLOCKER
Unlimited brute-force attempts possible on the login endpoint.
Suggested fix: Add per-IP rate limiter on
/loginPOST. Consider exponential backoff or account lockout after N failed attempts.