Brute-force login via unattached throttle

Missing rate limiting in Plainpad 1.1.1 and earlier allows remote attackers to brute-force accounts and interrupt service via POST /v1/sessions. The login route accepts unauthenticated requests without any effective throttle because App\Http\Kernel.php defines the api limiter in dead code under the Laravel 11+ skeleton, bootstrap/app.php never calls throttleApi(), and the route lacks a dedicated throttle middleware. Any internet-reachable Plainpad instance exposes the login API; attackers with a known email address can run unlimited password guesses and drive repeated bcrypt checks until CPU use rises, but the record does not indicate direct code execution or data modification.