No rate limiting on /api/unlock-expert

[CyberSunil]

The endpoint in app.py accepts unlimited key attempts. PBKDF2 makes each guess costly but doesn't stop a script. Add a per-session failed-attempt counter with a cooldown, stored alongside the other fields in prog().

File: app.py

[Neerajtata1527]

would love to contribute!