- Shipped
- September 4, 2026 at 11:10 PM UTC
- Author
- Kamo
- Commit
- f6feb4a
PROGRESSIVE_LOGIN_LOCKOUT joins DetectionRuleType. Every other value on that enum describes something a tenant opts into; this one describes a control SecurityService applies to every sign-in whether a row exists or not. The row exists so the policy is visible on the Security screen and its alert recipients are configurable — not so it can be turned off. The ladder itself is not per-org data and does not live in the table. 26 characters, so it fits rule_type varchar(30) with no DDL, and the column is mapped EnumType.STRING, so appending relabels no existing row. LOGIN_LOCKOUT_IP_BLOCKED is the letter sent when an address exhausts the whole ladder and lands on the permanent blocklist. It is the only alert in this family whose subject is not a member — it is about an attacking address — so every field it carries is attacker-controlled and every one of them uses the escaped twin. TemplateRenderer does no escaping of its own.