No server-side rate limiting on the OTP resend

Bug Reports
1
  1. Endpoint: POST /en/company/email-verification/resend-email-code/{id}
  2. Issue: No server-side throttling — rate limit only enforced client-side via JS timer, trivially bypassed by replaying the raw XHR request.
  3. PoC steps:

    • Open DevTools → Network tab on the email-verification page.

    • Right-click the resend-email-code request → Copy → Copy as cURL.

    • Replay the exact request 5+ times within the “cooldown” window.

    • Observe: every call returns {"success":true} and (presumably) a new email is sent each time.

  4. Suggested fix: Enforce the cooldown server-side — track last-sent timestamp per token/session and reject requests before the interval elapses (HTTP 429).