[Security] Medium issues: error leaks, no rate limiting, weak defaults, no password policy