Kyle Pope 8e27f2920b M-02: Timing-safe login prevents username enumeration ...

When a login targets a non-existent username, run Argon2id against a
pre-computed dummy hash so response time (~60ms) matches wrong-password
attempts. Also reorder the login flow to run verify_password_with_upgrade
BEFORE the lockout check, preventing timing side-channels that could
distinguish locked accounts from wrong passwords.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-27 15:44:27 +08:00

..

jobs

Fix QA review #2: W-03/W-04, S-01 through S-04

2026-02-27 05:41:16 +08:00

models

Fix QA review #2: W-03/W-04, S-01 through S-04

2026-02-27 05:41:16 +08:00

routers

M-02: Timing-safe login prevents username enumeration

2026-02-27 15:44:27 +08:00

schemas

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

services

Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)

2026-02-26 19:06:25 +08:00

__init__.py

Initial commit

2026-02-15 16:13:41 +08:00

config.py

Harden infrastructure: address 7 pentest findings

2026-02-25 19:57:29 +08:00

database.py

Fix code review findings: security hardening and frontend fixes

2026-02-16 07:49:21 +08:00

main.py

H-01: Add global CSRF middleware for all mutating endpoints

2026-02-27 15:39:42 +08:00