{
    "security.rate_limit_default": {
        "category": "security",
        "description": "Default rate limit for all HTTP endpoints. Configured via LDR_SECURITY_RATE_LIMIT_DEFAULT environment variable. Multiple limits can be separated by semicolons (e.g., '5000 per hour;50000 per day'). Format: 'N per hour/minute/day'. Requires server restart.",
        "editable": false,
        "max_value": null,
        "min_value": null,
        "name": "Default Rate Limit",
        "type": "APP",
        "ui_element": "text",
        "value": "5000 per hour;50000 per day",
        "visible": false
    },
    "security.rate_limit_login": {
        "category": "security",
        "description": "Rate limit for login attempts to prevent brute force attacks. Configured via LDR_SECURITY_RATE_LIMIT_LOGIN environment variable (e.g., '5 per 15 minutes'). Requires server restart.",
        "editable": false,
        "max_value": null,
        "min_value": null,
        "name": "Login Rate Limit",
        "type": "APP",
        "ui_element": "text",
        "value": "5 per 15 minutes",
        "visible": false
    },
    "security.rate_limit_registration": {
        "category": "security",
        "description": "Rate limit for registration attempts to prevent spam. Configured via LDR_SECURITY_RATE_LIMIT_REGISTRATION environment variable (e.g., '3 per hour'). Requires server restart.",
        "editable": false,
        "max_value": null,
        "min_value": null,
        "name": "Registration Rate Limit",
        "type": "APP",
        "ui_element": "text",
        "value": "3 per hour",
        "visible": false
    },
    "security.rate_limit_settings": {
        "category": "security",
        "description": "Rate limit for settings modification endpoints. Configured via LDR_SECURITY_RATE_LIMIT_SETTINGS environment variable. Requires server restart.",
        "editable": false,
        "max_value": null,
        "min_value": null,
        "name": "Settings Rate Limit",
        "type": "APP",
        "ui_element": "text",
        "value": "30 per minute",
        "visible": false
    },
    "security.session_remember_me_days": {
        "category": "security",
        "description": "Number of days a 'Remember Me' session remains valid before requiring re-login.",
        "editable": true,
        "max_value": 30,
        "min_value": 1,
        "name": "Remember Me Duration (Days)",
        "type": "APP",
        "ui_element": "number",
        "value": 30,
        "visible": true
    },
    "security.session_timeout_hours": {
        "category": "security",
        "description": "Session timeout in hours for sessions without 'Remember Me' checked. Only applies to internal session validation (browser sessions expire on close).",
        "editable": true,
        "max_value": 24,
        "min_value": 1,
        "name": "Session Timeout (Hours)",
        "type": "APP",
        "ui_element": "number",
        "value": 2,
        "visible": true
    },
    "security.account_lockout_threshold": {
        "category": "security",
        "description": "Number of consecutive failed login attempts before an account is temporarily locked out. Only configurable via environment variable (LDR_SECURITY_ACCOUNT_LOCKOUT_THRESHOLD).",
        "editable": false,
        "max_value": 50,
        "min_value": 3,
        "name": "Account Lockout Threshold",
        "type": "APP",
        "ui_element": "number",
        "value": 10,
        "visible": false
    },
    "security.account_lockout_duration_minutes": {
        "category": "security",
        "description": "Duration in minutes that an account remains locked after exceeding the failed login threshold. Only configurable via environment variable (LDR_SECURITY_ACCOUNT_LOCKOUT_DURATION_MINUTES).",
        "editable": false,
        "max_value": 60,
        "min_value": 1,
        "name": "Account Lockout Duration (Minutes)",
        "type": "APP",
        "ui_element": "number",
        "value": 15,
        "visible": false
    }
}
