argon2id-owasp-2024-settings-for-r-same-auth
R-Same’s PasswordService uses argon2id with OWASP 2024 parameters: time=3, memory=64MB, parallelism=4. Password policy requires zxcvbn score ≥3 and minimum 12 characters with Runwal-context blacklist. Login lockout triggers at 10 consecutive failures for 15 minutes. These are frozen security invariants; changing them requires an ADR supersede.