Rate Limiting Missing on API Routes

Your v0-generated Next.js API routes have no rate limiting, allowing unlimited requests from any client. This exposes your application to brute force attacks on authentication endpoints, API abuse that drives up database and third-party service costs, and denial-of-service scenarios.

Without rate limiting, a single malicious user can hammer your /api/auth/login endpoint thousands of times per second trying different passwords, or scrape your entire /api/users endpoint by paginating through all records at maximum speed.

Vercel's serverless functions do not include built-in per-user rate limiting, so your v0-generated routes are completely unprotected by default. You need to add application-level rate limiting using either in-memory stores for single-instance deployments or Redis-backed stores for production.