TL;DR
I checked 50 AI-generated login endpoints. Zero had rate limiting.
Attackers can brute-force credentials at full speed against these routes.
Adding a rate limiter takes four lines and one npm install.
I asked Cursor to build a login route for a side project last month. Email, password, JWT back on success. It worked first try, passed my manual tests, and I moved on to the next feature. Three weeks later I ran a load test against it out of curiosity and hit the endpoint two thousand times in under a minute. Not one request got throttled.
