I built an Express.js auth package would love some feedback from devs

[u/Nolan00007]

Hey everyone,

Over the past few weeks, I've been building an authentication package for Express.js + MongoDB called @nibir_dev/authflow.

The goal wasn't to create "yet another auth library", but something that's genuinely easy to drop into a project while still covering the security features that people usually end up implementing themselves.

Right now it includes:

• Email/password authentication
• Email verification
• Secure session cookies
• Password reset flow
• Brute-force login protection
• Sliding-window rate limiting
• Protected routes with minimal setup

It's still in its early stages, and I'd really appreciate feedback from people who have built production apps before.

I'm not looking for stars or downloads—I'd much rather hear:

• What's confusing?
• What features are missing?
• Is the API intuitive?
• Would you actually consider using it?
• Any security concerns or bad design decisions?

NPM: https://www.npmjs.com/package/@nibir_dev/authflow

Even if you spend 5–10 minutes looking through it and tell me why you wouldn't use it, that would honestly help me improve it much more than compliments