1c66eb84b1
`/auth/forgot-password` and `/auth/resend-verification` both take care to say "if that email exists" and both then answered the question anyway. The reset limiter returned early for an unknown address, so it counted nothing for one and counted for the other: ask four times and a registered address gets 429 while an unknown one gets 200 for ever. It counts either way now — in Redis for an address with no rows to count, keyed by a fingerprint, because a list of addresses somebody tried is itself worth not keeping. Resend answered "Email already verified." for a known verified address and "if that email exists" for everything else, which is not a hint but an answer. One sentence for every outcome now. And Editorial has a way to write something. Drafting was only reachable from the library — a page about reading, behind a button an educator arriving to work has no reason to look for — so the two panels now open from a link. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TqXevQJhxFrM7jJg82cgZN |
||
|---|---|---|
| .. | ||
| public | ||
| src | ||
| .dockerignore | ||
| docker-entrypoint.sh | ||
| Dockerfile | ||
| index.html | ||
| nginx.conf | ||
| package-lock.json | ||
| package.json | ||
| vite.config.js | ||