- F2: per-IP rate limits on POST /api/users, /login, /forgot-password
via new Next middleware (5/h signup, 10/15min login, 5/h forgot);
429 + Retry-After, generic Arabic error, no UX change
- F7: ghost-email logins burn the same PBKDF2 cost (600k/32/sha256)
as real verifies, closing response-time user enumeration
- F4: HSTS max-age=63072000; includeSubDomains on all routes
- F1: Traefik pagelimit (60/min, burst 120) + connlimit (in-flight 50)
on the page router; apilimit untouched
- Pentester accounts (ids 42-48) deleted in prod DB
AHMED