Security

Basic rate limiting is active in includes/security.php. Add Cloudflare/WAF on production.