Duplicate account creation is difficult

When a single IP can create unlimited accounts, bans become meaningless — a banned user creates a fresh account and resumes immediately. CWE-799 applies: without account-creation rate limiting, the enforcement system is trivially circumvented. Beyond ban evasion, unrestricted signup enables large-scale coordinated behavior: sock puppet networks, fake review farms, and artificially inflated user counts that distort analytics and business decisions. Platforms without IP-level account limits also bear the database and email delivery cost of every throwaway account created during attacks.

Apply IP-based rate limiting to the signup endpoint in src/app/api/auth/signup/route.ts:

import rateLimit from 'express-rate-limit';

export const signupLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 5,                   // 5 accounts per IP per hour
  keyGenerator: (req) => req.ip,
  message: 'Too many accounts created from this IP. Try again later.',
});

For higher-assurance requirements, add phone verification (Twilio Verify or similar) as a second factor on signup. This raises the cost of duplicate account creation from zero to per-number SMS pricing.