cjkas bab83313ee feat: throttle failed logins per client IP ... PR C of SECURITY_PLAN.md: after 5 failed /login attempts an IP is refused for 30 s, and each failure after that refuses it for twice as long, up to 15 min. A success resets it, as does an hour without a failure. - LoginThrottle.h holds the schedule and 8 IPs, with the time passed in so native tests cover it. While all 8 hold recent failures, every other IP shares one more slot, so many addresses don't each get five free tries. - A refused IP gets 429 with Retry-After before its credentials are checked, so a right guess during a lockout reveals nothing. Home Assistant retries a 429 instead of asking for new credentials. - The web UI's login panel shows a 401's or 429's message, where it popped a service error. - test/e2e --lockout checks it on a Secured device and waits it out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-10-26 22:08:30 +01:00
..
adr	fix: web UI client review findings (step 2a)	2026-10-25 18:04:07 +01:00
KNOWN_ISSUES.md	docs: move open known issues to GitHub, drop the finished plans	2026-10-21 13:27:49 +02:00
NICE_TO_HAVE.md	docs: add agent testing instructions and the RMT transmit idea	2026-10-16 09:11:17 +02:00
PROTOCOL.md	fix: drop Secure Config Only permissions from protocol 2	2026-10-25 11:11:19 +01:00
SECURITY_PLAN.md	feat: throttle failed logins per client IP	2026-10-26 22:08:30 +01:00