This extension protects against:

• Password theft - Argon2id hashing with high memory cost
• Brute force - Account lockout and rate limiting
• User enumeration - Timing-safe verification, generic error messages
• Token theft - Hashed storage, expiry limits
• Replay attacks - Single-use reset tokens

Passwords use Argon2id with OWASP-recommended parameters:

These settings resist GPU and ASIC attacks while remaining usable on modest hardware.

zxcvbn checks password strength:

• Minimum score: 2 (fair)
• Minimum length: 8 characters
• Checks for: dictionary words, keyboard patterns, personal info, common passwords

Limits apply per IP address combined with email (where applicable).

After 5 failed login attempts, the account locks for 15 minutes.

The lockout:

• Applies per account, not per IP
• Clears automatically after 15 minutes
• Clears on successful login after lockout expires

Password reset tokens:

TOTP 2FA with RFC 6238 compliance:

• Secret: 160-bit random
• Time step: 30 seconds
• Algorithm: SHA-1 (standard for TOTP)
• Code length: 6 digits

Rate limited to 3 attempts per 5 minutes to prevent code exhaustion.

Sessions inherit grist-core's session handling:

• Set GRIST_SECURE_COOKIES=true for HTTPS-only cookies
• Set GRIST_COOKIE_SAMESITE=Lax for CSRF protection

1. No password history - Users can reuse old passwords
2. No per-user reset limit - Could generate many reset emails for one user
3. OIDC UNPROTECTED mode - Available for development only

Report security issues privately via GitHub Security Advisory:

1. Go to the repository Security tab
2. Click "Report a vulnerability"
3. Provide details and reproduction steps

We aim to respond within 48 hours and fix critical issues within 7 days.