36^6 is 2,176,782,336, only a hair over 31 bits of entropy.

Unless you have some sort of throttling implemented, that's not really a lot and could probably be brute forced.