By: Michael Lynch <git@mtlynch.io>
Return 429 for rate-limited login attempts Rate-limited requests were silently returning an empty entry (same as unregistered emails) to prevent email enumeration. But an attacker needs a valid registered email to trigger rate limiting, so the 429 doesn't leak meaningful information. Restoring the status code gives operators HTTP-level visibility into rate limiting without weakening anti-enumeration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>