Protected by rate limiting & two-factor authentication