Insecure Design Security Check (A04:2021)

Analyze PHP code for insecure design patterns — architectural and business logic security flaws that cannot be fixed by implementation alone.

Detection Patterns

1. Missing Account Lockout

// VULNERABLE: No brute-force protection
class LoginController
{
    public function login(Request $request): Response
    {
        $user = $this->userRepo->findByEmail($request->get('email'));
        if ($user && password_verify($request->get('password'), $user->passwordHash())) {
            return $this->createSession($user);
        }
        return new Response('Invalid credentials', 401);