From ffdb01513cd3b2f410689fdeab1ec4a22c3dde3e Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Mon, 13 Jul 2026 10:16:26 -0700
Subject: [PATCH] Note lack of rate-limiting

---
 docs/installation/index.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/docs/installation/index.md b/docs/installation/index.md
index 9dd363c69..1905448cd 100644
--- a/docs/installation/index.md
+++ b/docs/installation/index.md
@@ -53,7 +53,11 @@ Use an `https://` URL for public or TLS-terminated deployments so authentication
 
 For password-only login:
 
-- `HOMEPAGE_AUTH_PASSWORD` (password-only login; required unless OIDC settings are provided)
+- `HOMEPAGE_AUTH_PASSWORD` (a strong, unique password; required unless OIDC settings are provided)
+
+!!! warning
+
+    Homepage does not apply application-level rate limiting to password attempts. Deployments exposed outside a trusted network should configure their reverse proxy or ingress to rate limit POST requests to `/api/auth/callback/credentials`.
 
 For OIDC login (overrides password login):