Warnings
Password reset lacks rate limiting
No rate limiter observed on forgot-password requests.
Severity: medium Verified from source
Evidence
Traced during VibeKB initialization of Arcana. Documented rather than fixed (application safety rule).