The public-facing stack has no rate-limiting or WAF guidance. Add Traefik middleware for per-IP rate limits (tighter on login, looser on API), document enabling OWASP Core Rule Set (ModSecurity) for operators, and ship an override-friendly default config.
The public-facing stack has no rate-limiting or WAF guidance. Add Traefik middleware for per-IP rate limits (tighter on login, looser on API), document enabling OWASP Core Rule Set (ModSecurity) for operators, and ship an override-friendly default config.