Repository navigation

Harden login: brute-force throttle, timing equalisation, first-run race - #1460

Merged

Tim020 merged 6 commits into

devfrom

feature/security-login-hardening

Oct 22, 2026

Merged

Harden login: brute-force throttle, timing equalisation, first-run race#1460
Tim020 merged 6 commits into
devfrom
feature/security-login-hardening

Commits on Oct 19, 2026
- Harden login: throttle failed attempts, equalise timing, bound locks, serialise first-run user creation
  
  Tim020
  and
  claude
  committed
  5f84d90
- Reorganise login tests into files mirroring the code under test
  
  Tim020
  and
  claude
  committed
  b4cb012
Commits on Oct 21, 2026
- Merge origin/dev into feature/security-login-hardening
  
  Tim020
  and
  claude
  committed
  8355caa
- Generate the dummy bcrypt hash at runtime and share the first-run concurrency test helper
  
  Tim020
  and
  claude
  committed
  b0be93f
Commits on Oct 22, 2026
- Address review: atomic login attempt reservation, decay from lockout end, shared create lock, tests
  
  Tim020
  and
  claude
  committed
  88d4436
- Restore exact throttle state when a reserved login attempt succeeds
  
  Tim020
  and
  claude
  committed
  179f818