This is one of my go-to checks for actual security (not the one in yhe certification)

- limits on the length

- limits on the characters

- blocking paste

- weird limits on the email

This is a sign of a lack of real competence