The js/missing-rate-limiting rule does not recognise @fastify/rate-limit's per-route config.rateLimit pattern and flags every route handler as unprotected. All flagged routes already have rate limiting configured. Switch from CodeQL default setup to an advanced workflow with a custom config that excludes this rule while keeping the security-extended suite.