Marc-André Bombeck b882698a44 feat(auth): warn on breached passwords at password set ...

Check a newly chosen password against HaveIBeenPwned through the k-anonymity
range API: only the first five hex characters of the SHA-1 digest leave the
host, the suffix is matched locally, and Add-Padding hides the bucket size.
A confirmed match is rejected so a fresh credential is never a known-breached
one; the check fails open, so an unreachable HIBP never blocks the operation.
Covers registration, password change, and admin reset. Existing passwords are
never retroactively blocked at login.

Also lands the six-locale strings for the password-breach notice and the
account-security surfaces that follow.

2026-06-27 20:34:20 +02:00

..

__tests__

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

route.ts

feat(auth): warn on breached passwords at password set

2026-06-27 20:34:20 +02:00