r-same-auth-constant-time-generic-errors-required

R-Same auth implementation uses constant-time credential failure (dummy argon2 hash on unknown email to eliminate timing oracle) and generic error messages (‘Invalid email or password’) that never reveal account existence. These are not optional polish — they are the OWASP-mandated baseline. Any future modification to login/MFA flows must preserve both properties or the security posture regresses.

Related

• r-same-m1-identity-backend-core-wave-1-pass-1
• r-same-azure-ad-sso-deferred-local-auth-v1
• r-dash-azure-ad-deferred-local-auth-v1-stack
• vantage-rbac-rls-non-negotiable-v1-gate
• r-same-internal-platform-scope-eliminates-product-concerns
• constant-time-auth-prevents-email-enumeration
• constant-time-auth-failure-prevents-email-enumeration
• secret-scanner-flags-test-passwords-without-constant-label
• test-password-strings-trigger-secret-scanner-false-positives
• argon2id-owasp-2024-params-for-password-hashing
• refresh-token-rotation-must-be-atomic-same-transaction