On point 7, the rate limit key uses the first x-forwarded-for value, and that one is set by the client. If the host doesn't overwrite the header, someone can rotate it per request and never hit the limit. Using the platform's own client IP header, or the last trusted hop, closes that, and it's worth pairing the IP with the account or email for OTP routes.