[Security] Add rate limiting to password reset and login endpoints (#592)

[G-nagavarshini]

Changes Made

• Implemented rate limiting middleware for login and password reset endpoints.
• Prevents brute force attacks by limiting repeated attempts.
• Configured using express-rate-limit with IP + user-based policies.

How to Test

• Attempt multiple login requests with incorrect credentials.
• Confirm that after the threshold, requests are blocked with 429 Too Many Requests.
• Same behavior applies to password reset endpoint.

Notes for Reviewer

• Linked to issue [Security] Missing rate limiting on password reset and login endpoints allows brute force attacks #592.
• Middleware is centralized for easy adjustment of limits.

Summary by CodeRabbit

• Chores
  • Updated automated security checks to run with Node.js 24 for improved compatibility and current runtime support.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f8decbec-4773-4718-91bd-bfd091be164c

📥 Commits

Reviewing files that changed from the base of the PR and between 3b41e28 and 7aa3bf3.

📒 Files selected for processing (1)

• .github/workflows/security.yml

---

📝 Walkthrough

Walkthrough

The security workflow updates its Node.js setup from version 20 to version 24 for dependency audit jobs.

Changes

Security workflow

Layer / File(s)	Summary
Update audit runtime .github/workflows/security.yml	The dependency audit workflow now uses Node.js 24 instead of Node.js 20.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: enhancement, type:feature

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes rate limiting, but the summarized changes only update Node.js from version 20 to version 24 in the security workflow.	Rename the title to describe the Node.js 24 security workflow update, or include the rate-limiting changes in the pull request.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request shows signs of AI-generated slop (description_diff_mismatch). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.