timandClaude Sonnet 5 fbe0c3aa18 Add login lockout and encrypt Player.totp_secret/auth_token at rest ...

Per-username lockout (5 failed TOTP attempts / 5 min) stops account-targeted
brute force regardless of source IP. Player.totp_secret is now Fernet-
encrypted (ENCRYPTION_KEY env, db/crypto.py) instead of stored in plaintext,
and auth_token is stored as a SHA-256 hash rather than the raw session token.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-01 19:49:56 +02:00

..

__init__.py

Add self-hosted usage analytics: pageview tracking + admin stats dashboard

2026-07-01 19:43:10 +02:00

auth.py

Add login lockout and encrypt Player.totp_secret/auth_token at rest

2026-07-01 19:49:56 +02:00

history.py

Apply velvet-table redesign, fix game lifecycle and history bugs

2026-07-01 00:11:42 +02:00

stats.py

Add self-hosted usage analytics: pageview tracking + admin stats dashboard

2026-07-01 19:43:10 +02:00