# Review a Pull Request Diff

Source: https://coremesh.online/prompts/review-a-pull-request-diff/

Review this pull request. Purpose: Adds rate limiting to the login endpoint.

```diff
--- a/api/auth.py
+++ b/api/auth.py
@@
+attempts = {}
+def login(user, pw):
+    attempts[user] = attempts.get(user, 0) + 1
```

Report in this order, each item with file and line:
1. Bugs (wrong behaviour, crashes, security problems).
2. Risks (concurrency, performance, missing tests, breaking changes).
3. Small things (naming, readability), at most five.
If something is fine, don't mention it. Don't rewrite the PR; suggest the smallest change for each item.