The original title is about Cursor skipping rate limits on login routes, with a CWE-307 reference. Let me rewrite this for a mobile feed.

Short summary

The author tested 50 AI-generated login endpoints and found zero had rate limiting, leaving them vulnerable to brute-force credential stuffing. Cursor and Claude Code produce correct auth logic but skip rate limiting because it's cross-cutting middleware outside the route function. Adding express-rate-limit takes four lines of config, and tools like SafeWeave can flag the gap automatically via MCP integration.

• •50 AI-generated login endpoints checked, zero had rate limiting (CWE-307)
• •Models skip rate limiting because it's middleware outside the route function, not part of auth logic
• •Fix is 4 lines of express-rate-limit middleware; SafeWeave MCP can flag missing limiters automatically

Generated with AI, which can make mistakes.