Brute-force lockout escalation

Independent of Caddy rate limit

The lockout is per identifier. The Caddy rate limit is per IP. Both fire independently. A distributed attack across many IPs hits the SDK lockout; a single-IP burst hits Caddy first.

Manual unlock

Admins can unlock via Athena → Locked Accounts. See Operate, Locked account unlock.

Where to learn more

• Security, Brute-force protection
• Security, Account lockout
• Cookbook, Test brute-force locally