I learned this the hard way: an exposed Jellyfin or Vaultwarden instance without rate-limiting is a free buffet for credential stuffing bots. This is the setup I now apply to every public-facing self-hosted service. What rate-limiting actually prevents Brute-force login attacks : bots trying co...
Source: [Dev.to](https://dev.to/scsoi/why-i-rate-limit-every-self-hosted-service-and-you-should-too-4n6b)