diff --git a/README.md b/README.md
index dde880c..d79f356 100644
--- a/README.md
+++ b/README.md
@@ -8,8 +8,10 @@ Self-hosted habit tracking service with a clean, hexagonal architecture.
 - **Flexible scheduling**: Daily, Weekly, Monthly with specific days
 - **Carry-over support**: Choose if incomplete habits persist or expire
 - **Full history tracking**: Complete audit trail of all interactions
-- **Charts & Analytics**: Heatmaps, line charts, and statistics
+- **Statistics**: Track streaks, completion rates, and progress
 - **Self-hosted first**: Easy deployment with SQLite
+- **Security**: JWT authentication, rate limiting on auth endpoints
+- **API Documentation**: Interactive Swagger UI
 
 ## Quick Start
 
diff --git a/go.mod b/go.mod
index 32b724b..8d009f8 100644
--- a/go.mod
+++ b/go.mod
@@ -7,6 +7,7 @@ toolchain go1.24.10
 require (
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/cors v1.2.2
+	github.com/go-chi/httprate v0.7.4
 	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/uuid v1.6.0
 	github.com/joho/godotenv v1.5.1
diff --git a/internal/infrastructure/http/router.go b/internal/infrastructure/http/router.go
index 9c13c50..3f6b5c2 100644
--- a/internal/infrastructure/http/router.go
+++ b/internal/infrastructure/http/router.go
@@ -2,12 +2,14 @@ package http
 
 import (
 	"net/http"
+	"time"
 
 	"apocapoc-api/internal/infrastructure/auth"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
+	"github.com/go-chi/httprate"
 	httpSwagger "github.com/swaggo/http-swagger"
 
 	_ "apocapoc-api/docs"
@@ -38,6 +40,7 @@ func NewRouter(corsOrigins string, habitHandlers *HabitHandlers, authHandlers *A
 	})
 
 	r.Route("/api/v1/auth", func(r chi.Router) {
+		r.Use(httprate.LimitByIP(10, 1*time.Minute))
 		r.Post("/register", authHandlers.Register)
 		r.Post("/login", authHandlers.Login)
 	})