- Shipped
- September 17, 2026 at 4:16 AM UTC
- Author
- Kamo
- Commit
- 3392afe
The reset page sent the 8-character code from the letter on its own, and SecurityService checked it against every account's outstanding reset at once, with no count. SecurityService now binds a code to the account the typed address names and allows five tries an hour per address and account (CodeAttemptLimiter). The code-only request still works, but it shares one small budget across the whole platform, so this page must send the address. - reset-password/page.tsx: the verify-code request carries the address the member typed to request the letter (always present on this page, since the code form only appears after it). A refusal comes back as 429 with a message, which the page already shows. - api/recover proxy: forward X-Forwarded-For and X-Real-IP verbatim, as kamo-register's proxy does. Over cluster DNS every recovery request otherwise arrives from this pod, so the per-address limit could not tell callers apart and has to skip them. Either deploy order works. SecurityService ignores unknown JSON properties, so an older one simply drops the address, and a newer one still accepts the code-only request from an older page.