fix: MFA-enforced accounts leak enumeration via passwordless login guard order - #154

Open

smarcet wants to merge 2 commits into

feat/mfa-phase1---migrations--and--interfacesfrom

fix/passwordless-mfa-enumeration

Commits on Aug 12, 2026

fix: MFA-enforced accounts leak enumeration via passwordless login guard order
smarcet
committed
67043e3
test: assert the passwordless rejection is indistinguishable, not just unworded
smarcet
committed
e6100e1