No rate limiting
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
An Express-based API has no rate-limiting middleware dependency, leaving it open to brute-force/abuse.
Why it matters
With no rate limiting, a script can hammer your login with password guesses or overload expensive endpoints as fast as your server responds. A basic limit makes credential brute-forcing impractical and keeps one abusive client from degrading the app for everyone. Hosting-level protection helps, but the app should enforce its own limits on sensitive routes.
How to fix it
Add express-rate-limit and apply a tight limiter to auth endpoints (login, signup, password reset) plus a general limiter for the API as a whole. Keep counters in memory for a single instance, or in Redis via rate-limit-redis when running multiple instances. Return 429 with a Retry-After header.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo