We identified and resolved an automated abuse vector targeting the magic link login system. All fixes are now live.
What changed
- CAPTCHA enforcement is now strict — if CAPTCHA verification cannot be completed server-side, the request is rejected. Previously, verification was skipped under certain configurations.
- Rate limiting is now persistent — magic link requests are throttled to 1 per email per 60 seconds and capped at 5 per email per 24 hours. Limits persist across server restarts.
- Abuse detection improved — the system now tracks request patterns at the database level rather than relying on in-memory state.
Impact
These changes do not affect normal login behavior. If you request a magic link, it arrives in your inbox as usual. The limits only apply if the same email address receives excessive requests in a short window.
Our commitment
Security improvements like this are shipped immediately, not batched into release cycles. If you notice anything unusual with your account or login experience, contact support.