Rate limiting middleware imported is actually applied

Constructing an @upstash/ratelimit or express-rate-limit instance and never calling .limit() or app.use(rateLimit(...)) leaves your endpoints open to credential stuffing, enumeration, and API cost amplification. CWE-400 (Uncontrolled Resource Consumption) is the direct mapping. The library's presence in package.json signals the developer anticipated abuse — but without invocation, every endpoint accepts unlimited requests. An attacker who discovers the rate limiter is never called can run brute-force or scraping at full speed.

Call .limit() per request at the top of each handler, or apply rateLimit() as global middleware. For Upstash:

import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const limiter = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(10, '10 s'),
})

export async function POST(req: Request) {
  const ip = req.headers.get('x-forwarded-for') ?? 'anonymous'
  const { success, remaining } = await limiter.limit(ip)
  if (!success) {
    return Response.json({ error: 'Too many requests' }, { status: 429 })
  }
  // ... rest of handler
}

For sensitive routes (login, password reset, signup), apply tighter limits than general API routes. Verify the .limit() call appears before any business logic.