forgia · dev log

Engineering log for the forgia LMS platform.

• 14 Jul 26
  The Rate Limiter That Throttles Everyone Except the Attacker

  A magic-link login has no password to brute-force, so the threat isn't guessing — it's spending. Someone else's inbox, and your finite mail quota. The obvious per-IP limit protects neither, and behind a reverse proxy it does something much worse than nothing.

  securityphoenixplughammerrate-limiting