Login protection (lockout)
Cloud Control locks sign-in after five failed attempts per email for 15 minutes — enumeration-safe, applied to unknown emails too, with a matching cap on wrong MFA codes.
To blunt brute-force and credential-stuffing attacks, Cloud Control locks authentication after repeated failures. The lockout is deliberately enumeration-safe.
Five strikes per email
Five failed sign-in attempts for the same email address lock that email for 15 minutes (configurable via LOGIN_LOCKOUT_SECONDS, default 900). While locked, `POST /api/auth/login` returns 429 with a Retry-After header — the identical response for a right password and a wrong one, so the lock cannot be used as an oracle.
Unknown emails count too
Failures are counted for the submitted email string whether or not an account exists, and the check runs before any password work. An attacker probing addresses gets the same lockout behavior for real and fake emails, revealing nothing about which are registered.
MFA codes have the same cap
MFA verification carries an equivalent cap: five wrong codes per user lock verification for the same window with a 429. A correct password or a correct code resets the relevant counter.
Everything is audited
Failed attempts are audited as auth.login_failed / auth.mfa_failed, and a lock as auth.login_locked / auth.mfa_locked. Review them on the Audit log.
Wait out the window, or use Password reset — a successful reset clears the failure counter for that email.