bridge-app exposes terminal sessions through a browser, so auth endpoints and WebSocket upgrades should have basic abuse controls.
Scope:
- add rate limiting to login/register/refresh routes
- consider per-IP and per-username throttling
- document recommended reverse-proxy limits for nginx/Caddy
- add tests around repeated failed login attempts
This is safe to discuss publicly because it is hardening work, not an active vulnerability report.
bridge-app exposes terminal sessions through a browser, so auth endpoints and WebSocket upgrades should have basic abuse controls.
Scope:
This is safe to discuss publicly because it is hardening work, not an active vulnerability report.