16. CWE-307 : Improper Restriction of Excessive Authentication Attempts
MIT-5 Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a whitelist of
acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to
specifications, or transform it into something that does.