fix: mitigate user enumeration vulnerability in recover endpoint#2549

Open

Jualhosting wants to merge 7 commits into

supabase:masterfrom

Jualhosting:fix-user-enumeration-clean

Commits on May 27, 2026

fix: mitigate user enumeration vulnerability in recover endpoint
Jualhosting
committed
fix: remove user-controlled aud from fake rate-limit cache key
Jualhosting
committed
fix: use database-backed fake rate limiter to fix TOCTOU and distributed bypass
Jualhosting
committed
fix: secure fake rate limits with HMAC-SHA256 and insert-first pattern
Jualhosting
committed
fix: mitigate timing attack on user enumeration by enforcing minimum response time
Jualhosting
committed
fix: global min response time and domain-separated HMAC secret
Jualhosting
committed
fix: implement probabilistic cleanup for fake rate limits table
Jualhosting
committed