ThrottlerModule.forRoot is configured (app.module.ts:70) but no global ThrottlerGuard is registered (no APP_GUARD anywhere). Only ApiKeyThrottlerGuard is applied manually to a few controllers, so most endpoints, including auth, are not rate-limited. The config gives a false sense of protection.
ThrottlerModule.forRootis configured (app.module.ts:70) but no globalThrottlerGuardis registered (noAPP_GUARDanywhere). OnlyApiKeyThrottlerGuardis applied manually to a few controllers, so most endpoints, including auth, are not rate-limited. The config gives a false sense of protection.