Manish Gupta 3257ee9305 [SECUR-236] fix: address CodeRabbit — composite account throttle key + rate guard ...

- AuthenticationAccountThrottle keyed on (email + client IP) instead of email
  alone. An email-only key let anyone lock a victim out of their own account by
  spamming their address from other IPs (self-inflicted lockout DoS). Combining
  with the client IP prevents that while still capping single-source guessing.
- Guard the AUTHENTICATION_ACCOUNT_RATE_LIMIT env value: a malformed rate would
  raise in DRF parse_rate() on every auth POST (throttle is instantiated per
  request), taking authentication down instance-wide. Falls back to the default.
- Add regression tests for both.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-28 15:12:13 +05:30

..

bin

…

plane

[SECUR-236] fix: address CodeRabbit — composite account throttle key + rate guard

2026-07-28 15:12:13 +05:30

requirements

chore(deps): bump cryptography (#9243)

2026-06-16 17:14:42 +05:30

templates

fix: update Twitter icon and links to X (#8785) (#8790)

2026-04-07 15:34:54 +05:30

tests

fix: Add docker pytest runner and fix bugs the suite surfaced (#9138)

2026-05-26 01:21:37 +05:30

.coveragerc

…

.env.example

…

.prettierignore

…

Dockerfile.api

…

Dockerfile.dev

…

manage.py

…

package.json

chore: bump up the package version

2026-04-20 17:20:12 +05:30

pyproject.toml

…

pytest.ini

…

requirements.txt

…

run_tests.py

…

run_tests.sh

…