valknarandClaude Sonnet 5
00cc3583ec
statuscode "400,401,403-499" counted almost every client error as a brute-force strike, so normal 404s/400s from routine app behavior could rack up 5 hits in 10 minutes and trip a 3h ban (returned as 429) for real users. Narrow to 401/403 (actual auth failures) and raise maxretry to 15 so it still catches real brute-forcing without false-positiving on noise. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>