# Missing Brute Force Protection

> Detects login and authentication endpoints that lack rate limiting, account lockout, or CAPTCHA protection.

- Skill: `zakirkun/missing-brute-force-protection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/missing-brute-force-protection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/missing-brute-force-protection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/missing-brute-force-protection

---


# Missing Brute Force Protection

## Overview
Authentication endpoints without rate limiting allow attackers to make unlimited login attempts, enabling:
- **Credential stuffing**: Testing breached username/password combinations
- **Password spraying**: Testing common passwords across many accounts
- **Dictionary attacks**: Exhaustively guessing passwords

## Detection Strategy
Identify login/authentication route handlers that do not implement:
- Rate limiting middleware (express-rate-limit, Flask-Limiter, etc.)
- Account lockout after N failed attempts
- CAPTCHA verification

## Remediation
- Add rate limiting to all authentication endpoints (e.g., 5 attempts per 15 minutes per IP)
- Implement progressive delays or account lockout after repeated failures
- Consider CAPTCHA for high-value applications
- Use fail2ban or similar at the infrastructure level

**Safe (Express.js):**
```js
const rateLimit = require('express-rate-limit');
const loginLimiter = rateLimit({
    windowMs: 15 * 60 * 1000,
    max: 5,
    message: 'Too many login attempts'
});
app.post('/login', loginLimiter, loginHandler);
```