CAPTCHA or rate limiting prevents bot posts

Without bot prevention, a single automated script can flood a community with thousands of posts per hour — overwhelming moderation queues, degrading feed quality, and inflating engagement metrics used to make product decisions. CWE-799 (Improper Control of Interaction Frequency) applies when there is no rate limiting or CAPTCHA on submission endpoints. OWASP A04:2021 (Insecure Design) frames the architectural gap: a platform designed without a bot prevention layer cannot be made safe by patching individual bugs. Bot floods are also the primary vector for coordinated inauthentic behavior, platform manipulation, and spam-link injection.

Apply rate limiting to every public-facing submission endpoint. Configure in src/middleware/rateLimiter.ts:

import rateLimit from 'express-rate-limit';

export const postLimiter = rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 10,             // 10 posts per minute per IP
  keyGenerator: (req) => req.ip,
  message: 'Too many submissions. Try again shortly.',
});

// Apply to all content routes
app.post('/api/posts', postLimiter, authenticate, createPost);
app.post('/api/comments', postLimiter, authenticate, createComment);

For higher-risk surfaces (public posting without auth), add hCaptcha or reCAPTCHA v3. A rate limit above 100 requests per minute does not satisfy this check as meaningful bot prevention.