v4.20.0 — Locked Gates

A security pass on the front gate — the doors that let a stranger near your account are welded shut. 🔐 🚫 No more password swaps on the sign-up door • Registering an address that already has a bay never touches that account — no password gets installed, no name is handed back. You get the same neutral "check your email" every time, and the mailbox itself is told what happened and pointed at Sign In, verify, or Forgot Password to get back in 🔑 Old keys can't ride a new login through the gate • When a Google or Discord sign-in links into an older email-and-password account whose inbox was never actually proven, the stale password is cut on the spot — a real mailbox proof always wins, and no legit collector gets logged out for it 🚦 The guess-limiter fails shut, not open • If the rate-limiter's backing store hiccups, the verification and account-deletion code doors now DENY instead of quietly waving guesses through — and email addresses are hashed out of the limiter's keys 🔧 Under the hood • Every mailbox now carries how it was proven (code, reset link, provider, or legacy), so the gate can always tell a real proof from an old assumption