fix(auth): invalidate email OTP on a failed guess, not just a match - #2224

Open

addyCooks wants to merge 4 commits into

CapSoftware:mainfrom

addyCooks:fix/otp-verification-token-brute-force

Commits on Sep 5, 2026

fix(auth): invalidate email OTP on a failed guess, not just a match
addyCooks
committed
2562bc1

Commits on Sep 6, 2026

fix(auth): make OTP consumption atomic to close concurrent-guess race
addyCooks
committed
1dd7b68
test(auth): cover OTP concurrent-guess atomicity against real MySQL
addyCooks
committed
6473cc9
test(auth): cover mixed correct/incorrect OTP guesses racing on real MySQL
addyCooks
committed
54e0bd5