439acdc1

By: Michael Lynch <git@mtlynch.io>

Return 429 for rate-limited login attempts

Rate-limited requests were silently returning an empty entry (same as
unregistered emails) to prevent email enumeration. But an attacker needs
a valid registered email to trigger rate limiting, so the 429 doesn't
leak meaningful information. Restoring the status code gives operators
HTTP-level visibility into rate limiting without weakening anti-enumeration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Timeline