Known limits

What Runique 4.0 doesn't do yet, or does with a restriction. Each line points to the page explaining the limit and what to do meanwhile. Open security findings are kept apart, in faille.md at the repository root.

Database and migrations

Limit	Details
One engine per build (`sqlite`, `postgres`, `mysql`) SQLite: one writer at a time, `SQLITE_BUSY` under heavy write load Switching engines needs a fresh database: data isn't carried over	Database
A column type change isn't migrated (`--force` writes an empty migration, to complete by hand) Snapshots copied without their migrations make the tables look created SQL identifiers capped at 64 characters on MySQL / MariaDB `migration up`: a migration is atomic under Postgres only (SQLite, MySQL / MariaDB: a failing migration can stay half applied) A hard stop during `makemigrations` can leave half-written files (`git` to restore)	Migrations, Makemigrations
`search!`: `in (vec)` with an empty vec, no inline conditional filter	Queries

Forms and messages

Limit	Details
A failed session write loses the flash message silently	Flash macros
A published file followed by a hard stop before the database commit can leave an orphan file	Fields

Security, sessions, authentication

Limit	Details
`RateLimiter` and `LoginGuard` have no memory cap `RateLimiter` and `LoginGuard` count per process: with several instances, the quota is multiplied	Rate limiting
`LoginGuard` locks by username: someone can lock an account whose name they know	LoginGuard
The in-memory session store belongs to one process	Session store
A custom store (`with_session_store`) can't be walked per user: a password reset doesn't close its sessions	Session
`Delegated` mode: no external provider (OAuth, LDAP, SAML) is implemented	Passwords
ACME: one site per machine (port 80 exclusive)	Network

Admin

Limit	Details
`.links`, `.search_help`, `.empty_value` accepted but with no effect on the display	ModelAdmin builder
No global theme stylesheet (workaround through a block) `.with_htmx` is global, no per-model list fragment A missing page template or stylesheet is only reported when shown	Template override
No session management interface	—
Many-to-many: declared in the DSL through a pivot table, not managed in the admin	Roadmap

Local development

Limit	Details
Cookies ignore the port: two projects on `127.0.0.1` share (and overwrite) the session cookie	Troubleshooting

Solutions in the meantime

Limit	Solution
`RateLimiter` and `LoginGuard` have no memory cap, counters per process	Also limit at the reverse proxy (example below)
`LoginGuard` blocks by username	Pair it with a limit per IP, at the reverse proxy or with `RateLimiter`
The memory session store belongs to one process	One instance, or a reverse proxy sending each visitor to the same one (`ip_hash` with nginx)
ACME: one site per machine	Hand TLS to a reverse proxy as soon as there are several sites
SQLite: one writer at a time	PostgreSQL for a sustained write load
A migration is atomic only on PostgreSQL	Back up the database before `migration up` on SQLite and MySQL / MariaDB
A column's type change isn't migrated	Complete by hand the migration written by `--force`
Cookies shared by two projects on `127.0.0.1`	Open one on `127.0.0.1`, the other on `localhost`

Limit per IP with nginx, to adapt. The zone caps the memory, and a refused request gets a 503 by default:

limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

location /login {
    limit_req zone=login burst=5 nodelay;
    proxy_pass http://127.0.0.1:3000;
}