Add rate limiting specifically to my authentication endpoints: login, signup, password reset, and any magic link or verification code request. Implement two layers: a per-IP limit (generous enough for shared networks, strict enough to slow scripted attacks) and a per-account limit on failed login attempts (for example, 5 failures triggers a 15-minute lockout for that account). Apply separate, stricter limits to password reset and code request endpoints since those send email and can be abused to spam users. Return a clear 429 response with a retry-after hint, and make the error message identical whether the account exists or not. Use the rate limiting approach that fits my stack (middleware for my framework, or a store backed by my existing database or Redis if present). Do not lock accounts permanently. Do not rate limit so aggressively that a user who typos their password a few times gets blocked for hours. Show me the limits you set for each endpoint and the reasoning. Give me a verification script or curl loop that hammers the login endpoint and shows the 429 kicking in at the right threshold.