Currently, PIN and password protection don't have any brute-force protection. At least I could try it like 15 times without any notification. Security would be far better even with a small brute-force protection like timeouts after 3 unsuccessfull attempts or so. Of course, a professional brute-force protection with block lists, etc. would be far better, but I can't measure the developing time needed to implement such a solution.
Originally created by @PottiMc on GitHub (Aug 31, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1386
Currently, PIN and password protection don't have any brute-force protection. At least I could try it like 15 times without any notification. Security would be far better even with a small brute-force protection like timeouts after 3 unsuccessfull attempts or so. Of course, a professional brute-force protection with block lists, etc. would be far better, but I can't measure the developing time needed to implement such a solution.
@oschwartz10612 commented on GitHub (Sep 1, 2025):
Hi! Thanks for the suggestion! This actually already is the case. There
is a server side rate limit on the endpoint that limits it to 15 in 15
minutes.
server/routers/external.ts:1023
<!-- gh-comment-id:3240816279 -->
@oschwartz10612 commented on GitHub (Sep 1, 2025):
Hi! Thanks for the suggestion! This actually already is the case. There
is a server side rate limit on the endpoint that limits it to 15 in 15
minutes.
server/routers/external.ts:1023
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @PottiMc on GitHub (Aug 31, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1386
Currently, PIN and password protection don't have any brute-force protection. At least I could try it like 15 times without any notification. Security would be far better even with a small brute-force protection like timeouts after 3 unsuccessfull attempts or so. Of course, a professional brute-force protection with block lists, etc. would be far better, but I can't measure the developing time needed to implement such a solution.
@oschwartz10612 commented on GitHub (Sep 1, 2025):
Hi! Thanks for the suggestion! This actually already is the case. There
is a server side rate limit on the endpoint that limits it to 15 in 15
minutes.
server/routers/external.ts:1023