## Is your feature request related to a problem?

It's possible to brute-force passwords if you're particularly determined

## Describe the solution you'd like

Install `django-axes`: https://django-axes.readthedocs.io/en/latest/2_installation.html


## Describe alternatives you've considered



## Additional context



#### *Thank you* for your feature request – we love each and every one!

posthog/api/test/test_decide.py
response = self._post_decide()
        self.assertEqual(response["sessionRecording"], False)
        self.team.session_recording_opt_in = True
        self.team.save()
        response = self._post_decide()
        self.assertEqual(response["sessionRecording"], {"endpoint": "/s"})
    def test_user_session_recording_evil_site(self):
        self.team.app_urls = ["https://example.com"]
        self.team.session_recording_opt_in = True
        self.team.save()
        response = self._post_decide(origin="evil.site.com")
        self.assertEqual(response["sessionRecording"], False)
        response = self._post_decide(origin="https://example.com")
        self.assertEqual(response["sessionRecording"], {"endpoint": "/s"})
    def test_feature_flags(self):
        self.team.app_urls = ["https://example.com"]
        self.team.save()
        self.client.logout()
        Person.objects.create(team=self.team, distinct_ids=["example_id"])
        FeatureFlag.objects.create(
            team=self.team, rollout_percentage=50, name="Beta feature", key="beta-feature", created_by=self.user,
        )
        
        FeatureFlag.objects.create(
            team=self.team,