#nodejs

Add per-IP rate limiting to the /api/login route. 5 attempts per 15 minutes. No new dependencies if possible.

No dependencies needed for a single-process API — an in-memory sliding window keyed by IP is enough. I’ll add a small middleware and note the multi-instance caveat.