### SMS Functionality Flow Key Check Items

Look for missing validations and state control.

- **Missing rate limiting**: Check for the risk of missing send frequency/count validation logic for the same phone number or IP before executing SMS sending code (leading to SMS bombing).
- **Missing human verification**: Review the risk of missing pre-front-end human verification mechanisms like CAPTCHA, sliders, etc. on public sending interfaces (leading to interfaces being maliciously flooded).
- **User-controllable content**: Review the risk of concatenating user-controllable parameters when constructing SMS content and sending to arbitrary recipients (leading to malicious SMS content injection).
- **Input not bound**: In sensitive operation secondary authentication (such as financial transfers, password changes, etc.), review whether the target phone number completely trusts frontend-passed parameters without binding to the current logged-in user session identity (leading to phone number secondary authentication failure).
