security: rate limiting & SSRF allowlists (sessions throttle, OTP rate limit, provider base_url)#1520

Open

dgilperez wants to merge 8 commits intowe-promise:mainfrom

dgilperez:security/pr5-ratelimit-ssrf

Commits on Apr 19, 2026

fix(security): throttle POST /sessions via Rack::Attack
dgilperez
committed
fix(security): F-06 rate limit OTP attempts on API login (Rack::Attack)
dgilperez
committed
fix(security): F-08 SSRF allowlist for Mercury/Lunchflow base_url
dgilperez
committed
fix(security): address CodeRabbit review
dgilperez
committed
fix(security): keep BaseUrlAllowlistable allowlist + validator in sync
dgilperez
committed
fix(security): validate allowed_base_urls input at declaration time
dgilperez
committed
docs(security): correct BaseUrlAllowlistable concern header wording
dgilperez
committed
fix(security): fail-closed on malformed allowed_base_urls at declaration
dgilperez
committed