Stronger Protection for Sign-Up and Sign-In
We hardened account creation and login against automated abuse and account-guessing, and added a bot challenge to registration.
What's changed
- Registration is now protected by a Cloudflare Turnstile challenge to keep automated sign-ups out
- Signing up always ends on a neutral check-your-email step, so the form never reveals whether an address already has an account
- Password-reset and sign-up responses no longer disclose whether an email is registered
- Added rate limiting to registration, password-reset, and email-verification requests
- Login now takes constant time, closing a subtle way to probe for valid emails
- Your active sessions are re-validated when you change your email or two-factor settings