diff --git a/README.md b/README.md
index 10b4169..0b7c145 100644
--- a/README.md
+++ b/README.md
@@ -77,7 +77,7 @@ IPFS (feedback blobs; CID stored on-chain)
 ```bash
 cd frontend
 npm install
-cp .env.local.example .env.local   # or create .env.local (see frontend/README.md)
+cp .env.local.example .env.local   # fill NEXT_PUBLIC_API_URL and contract IDs (see frontend/README.md)
 npm run dev
 ```
 
@@ -88,7 +88,7 @@ Open [http://localhost:3000](http://localhost:3000).
 ```bash
 cd backend
 docker compose up -d
-cp .env.example .env               # fill STELLAR_SERVER_SECRET, JWT_SECRET
+cp .env.example .env               # fill STELLAR_SERVER_SECRET, JWT_SECRET, CORS_ORIGINS
 npm install
 npm run prisma:migrate
 npm run start:dev
diff --git a/backend/.env.example b/backend/.env.example
index 729e8e2..e6263c4 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -1,6 +1,7 @@
 DATABASE_URL="postgresql://quid:quid@localhost:5432/quid_dev?schema=public"
 PORT=3001
 JWT_SECRET="your-super-secret-jwt-key-change-this-in-production"
+CORS_ORIGINS="http://localhost:3000,http://localhost:3001"
 
 # Stellar / SEP-10
 STELLAR_SERVER_SECRET="S..." # Server signing keypair secret (Stellar secret key)
diff --git a/backend/package.json b/backend/package.json
index 0bbcf34..f4b4420 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -33,6 +33,7 @@
     "@nestjs/passport": "^11.0.5",
     "@nestjs/platform-express": "^11.0.1",
     "@nestjs/schedule": "^6.1.1",
+    "@nestjs/throttler": "^6.3.0",
     "@prisma/adapter-pg": "^7.5.0",
     "@prisma/client": "^7.5.0",
     "class-transformer": "^0.5.1",
diff --git a/backend/src/auth/auth.controller.ts b/backend/src/auth/auth.controller.ts
index d42a364..5b848cd 100644
--- a/backend/src/auth/auth.controller.ts
+++ b/backend/src/auth/auth.controller.ts
@@ -1,8 +1,10 @@
-import { Body, Controller, Get, Post, Query } from '@nestjs/common';
+import { Body, Controller, Get, Post, Query, UseGuards } from '@nestjs/common';
+import { ThrottlerGuard } from '@nestjs/throttler';
 import { AuthService } from './auth.service';
 import { VerifySignatureDto } from './dto/verify-signature.dto';
 
 @Controller('auth')
+@UseGuards(ThrottlerGuard)
 export class AuthController {
   constructor(private readonly authService: AuthService) {}
 
diff --git a/backend/src/auth/auth.module.ts b/backend/src/auth/auth.module.ts
index b3ee8b9..36999a9 100644
--- a/backend/src/auth/auth.module.ts
+++ b/backend/src/auth/auth.module.ts
@@ -2,6 +2,7 @@ import { Module } from '@nestjs/common';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
+import { ThrottlerModule } from '@nestjs/throttler';
 import { PrismaModule } from '../prisma/prisma.module';
 import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
@@ -12,6 +13,10 @@ import { JwtAuthGuard } from './jwt-auth.guard';
   imports: [
     ConfigModule,
     PrismaModule,
+    ThrottlerModule.forRoot([{
+      ttl: 60000,
+      limit: 10,
+    }]),
     PassportModule.register({ defaultStrategy: 'jwt' }),
     JwtModule.registerAsync({
       imports: [ConfigModule],
diff --git a/backend/src/main.ts b/backend/src/main.ts
index 4afe5f6..040f7a1 100644
--- a/backend/src/main.ts
+++ b/backend/src/main.ts
@@ -6,7 +6,9 @@ import { ValidationPipe } from '@nestjs/common';
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
   // CORS
-  app.enableCors();
+  app.enableCors({
+    origin: process.env.CORS_ORIGINS?.split(','),
+  });
 
   // Global validation pipe
   app.useGlobalPipes(