Correção
- Client IP address can be spoofed through Smart IP Detection (props: Karthik Ramakrishnan)
- Two-factor code verification is not rate limited by default (props: Karthik Ramakrishnan)
- Audit Log recovery query blocks the database
- Session Protection: Immediate logout after logging in with memory-only transients