article
The clock and a status code kept revealing which emails had accounts
Signup and login got the same words for everyone, but the same answer still leaked through response time, a lockout status code and a waited-on email step, plus a lowercase mismatch and unthrottled license-key endpoints. None of it is timed yet.
Read more