Rate-Limit Failed Logins Without Locking Out Victims
The naive 'N failures and this account is locked' turns your brute-force defense into a denial-of-service tool. The fix is one decision: what you key on.
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.