Guide
Auth endpoint shows no rate-limit headers
How StackSiren Deep Scan detects this issue and how to fix it. Severity typically low.
Why it matters
Auth endpoint shows no rate-limit headers is a common finding on vibe-coded and AI-built apps that ship client bundles, shared backends or platform defaults without a security pass.
StackSiren reports this from read-only checks (GET, HEAD or OPTIONS only). It does not exploit the issue.
How to fix it
Add rate limiting (and preferably CAPTCHA/lockout) on login, signup, magic-link and password-reset endpoints. Return 429 with Retry-After. Prefer edge/WAF limits in front of the app.
How StackSiren Deep Scan checks
Deep Scan runs only on hosts you have verified you own (DNS TXT or /.well-known file) and consented to test. Findings include a short evidence string; secret values are masked.
See the Acceptable Use Policy and Active scanning terms for what Deep Scan is and is not.