Discover how blackLen protects against credential stuffing, DoS flooding, session hijacking, and unauthorized privilege escalation.
Test simulated brute force attempts to trigger real-time HTTP 429 rate limiters and atomic MFA nonce invalidations.
Redis-Backed Independent Evaluation Tiers
Protects against single-source volumetric flood attacks while preserving connectivity for large corporate offices behind NAT gateways.
Tracks attempts against a specific account normalized and hashed via SHA-256 across all IP pools. Thwarts distributed botnet password spraying.
Binds the client IP address directly to the target username, instantly isolating aggressive single-attacker brute-force loops.
Simulate rapid password attempts to trigger the 3-Tier Multi-Vector Rate Limiter and atomic MFA lockout.
Stateless JWT tokens are physically bound to a client-generated UUID stored in localStorage and passed via the `X-Device-ID` header. Server-side `UserSession` records track IP addresses, browsers, and geographic locations with instant 1-click remote revocation.
MFA challenges enforce a strict 5-attempt atomic counter (mfa:attempts:{user_id}:{nonce}) stored in Redis. Upon 5 failed guesses, the nonce is permanently purged, preventing OTP brute-forcing. A cross-challenge cap of 10 failures locks the entire account.
Guarantees that an organization member with `Viewer` clearance can never be assigned or elevated to an `Editor`, `Admin`, or `Auditor` role on any individual project, preventing accidental privilege escalation to client observers.
During Redis network partitions, general API and background polling fail open gracefully with rate-limited warning logs, while sensitive authentication routes fallback to an in-process sliding window limiter to prevent unthrottled attacks.
Coordinated Vulnerability Reporting Guidelines
We welcome reports from security researchers and industry peers. If you believe you have discovered a vulnerability in the blackLen platform or architecture, we request that you adhere to coordinated disclosure:
support@blacklen.com.