NodeBB / NodeBB / 27285970808

85%

master: 85%

push

github

fix(auth): use dummy lockout key for non-existent users to prevent username enumeration

- Remove early return for non-positive uids in logAttempt
- Use a shared dummy key for lockout/attempts when uid is invalid
- Prevents username enumeration via lockout behavior discrepancy (CWE-203)

Assisted-by: unsloth/Qwen3.6-35B-A3B-GGUF

14111 of 19263 branches covered (73.25%)

7 of 7 new or added lines in 1 file covered. (100.0%)

29468 of 34496 relevant lines covered (85.42%)

3473.58 hits per line