Rate limiting
Also called throttling, token bucket, 429
Capping how many requests one person or address can make in a period, and answering 429 Too Many Requests after that. It makes guessing a password or a code slow enough to be pointless.
Without it, a 6-digit code falls to a script in a sitting. An endpoint that calls a paid model can also run up your bill overnight. It's invisible in testing, since nobody tests by sending a million requests.
Say it to your agent
“Rate limit /login to 5 tries a minute per account and 100 per IP, in a store shared across servers. Return 429 with Retry-After. Add a test that the sixth try fails and that one account being attacked doesn't block a different account.”