Does Lovable support rate limiting?

No, Lovable does not include built-in rate limiting for generated API endpoints. Without rate limiting, your application is vulnerable to brute-force attacks, credential stuffing, and denial-of-service attempts. Attackers can also abuse unprotected endpoints to scrape data or exhaust your Supabase quotas. You need to implement rate limiting manually using middleware, edge functions, or a service like Cloudflare. UNPWNED checks whether your API endpoints have rate limiting protection in place.