Auth and sessions
Login and code entry without rate limits
Passwords and one-time codes can be guessed at machine speed because nothing counts attempts.
TermsAPI (the interface other software calls; tested directly, without the UI in between) · cross-site request forgery (another site making a user's browser send a state-changing request with the user's cookies) · cross-site scripting (user-typed text rendered as markup, so a script in a name or comment runs in other users' browsers) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Every application in the 15-app comparison shipped a login page with zero rate limiting or lockout.
Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.
Source: Tenzai, 2026-01 · verified 2026-09-21
How we detect it
Send 20 failed attempts in a minute and watch for a refusal.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Login and code-entry endpoints are rate-limited with a lockout rule
automated Send 20 failed attempts within 60 seconds to login, OTP and password reset.
Attempts are refused before the 20th, and the refusal is logged with the account or address.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.