Jean f388e3d650 nickserv/security: password policy, auth throttle, unguessable codes ... Three brute-force / weak-secret gaps closed: - REGISTER and SET PASSWORD now enforce a length range and reject a password equal to the nick (Anope's minpasslen/not-nick rules), with tests. - IDENTIFY is throttled per account: a few free tries then an exponential backoff that clears on success, so a password can't be ground down. SASL had a limiter; interactive login had none. - Emailed confirm/reset codes go from 6 digits to 8 base32 chars (~40 bits) and are burned after a few wrong guesses, closing a reset-code takeover window. Throttle and code state are node-local and in-memory (not in the event log).		2026-07-13 02:28:47 +00:00
..
src	nickserv/security: password policy, auth throttle, unguessable codes	2026-07-13 02:28:47 +00:00
Cargo.toml	modules: split services and the ircd link into external crates	2026-07-13 01:33:56 +00:00