Account and session protections
Rate limits, lockouts and token handling.
For: Everyone Reviewed 15 October 2026
- Sign-in, password and public endpoints are rate-limited per client address.
- Accounts lock after repeated failures.
- Reset and invitation tokens are stored only as hashes.
- Sessions use short-lived access tokens with rotating refresh.