Summary
passkeykit-connector.ts has no rate limiting guard on authentication attempts, making it easier for a caller bug or abuse to hammer the passkey flow.
Requirements
- Add a client-side rate limiter keyed on connector instance
- Reject excess attempts with a typed RateLimitError
- Add tests verifying limiter behavior under repeated attempts
- Document the limiter configuration in the README
Summary
passkeykit-connector.ts has no rate limiting guard on authentication attempts, making it easier for a caller bug or abuse to hammer the passkey flow.
Requirements