Sign-in and vault key attempts are now rate limited
Failed password, authenticator-code, and custom vault key attempts now have rate limits. Throttled responses include a Retry-After header:
| Resource | Attempt Limit | Window | Scope |
|---|---|---|---|
| Passwords | 10 attempts | 15 minutes | Per account |
| Authenticator (TOTP) | 5 attempts | 15 minutes | Per account |
| Custom Vault Keys | 10 attempts | 15 minutes | Per user and IP |
#Additional security updates
- Content Security Policy: all responses include a nonce-based policy with
strict-dynamic, along with Strict-Transport-Security. - Expiring CLI tokens: newly approved CLI device tokens expire after 90 days.
- Audit logs: failed and denied key attempts—such as invalid vault keys, throttled reveals, and read-only refusals—are recorded with HTTP status and attempted event type.
#API improvements
The X-Project-Id header, projectId query parameter, and project log endpoints now accept project slugs as well as string IDs. The log API also filters by explicit status codes and log ID prefixes.
Learn more in the limits reference.