mirror of
https://github.com/HeyPuter/puter.git
synced 2026-09-14 09:15:45 +00:00
Daniel Salazar
5c8defb940
The only thing in front of the bcrypt compare on the DAV host was the 600/min request ceiling, keyed on a fingerprint that rotates with client-controlled headers. /login guards the same credential with a captcha and two much tighter buckets; DAV had neither, which left password and TOTP guessing viable from a host that answers any origin. The request ceiling can't double as a credential ceiling — a working DAV client resends its credentials on every request — so the new buckets count only verifications that failed: 10 per account and 50 per address per 15 minutes, sized like /login's. They're read before the compare, so an exhausted bucket costs no bcrypt round, and successful requests never draw them down. `-token` attempts are held by the address bucket alone; bucketing them per account would let bad tokens lock out good ones. Reading a bucket without spending from it is new, hence `peekRateLimit` and the matching `peek` on all three backends. Also documents the DAV limits, which were undisclosed.
Puter.js Docs
Docs · Developer · Puter.com · X
Puter.js Docs
The Puter.js documentation contains everything you need to build powerful applications with Puter.js.
- Get started with Puter.js by reading documentations on usage and best practices
- Browse all available APIs, including AI, networking, authentication, and cloud services
- Find code examples and implementations to speed up your development
Getting Started
💻 Local Development
git clone https://github.com/HeyPuter/docs
cd docs
npm install
npm run dev
→ This should launch Puter.js Docs at http://127.0.0.1:8080 (or the next available port).
Support
Connect with the maintainers and community through these channels:
- Bug report or feature request? Please open an issue.
- X (Twitter): x.com/HeyPuter
- Security issues? security@puter.com
- Email maintainers at hi@puter.com
We are always happy to help you with any questions you may have. Don't hesitate to ask!
License
This repository, including its sub-projects, modules, and components, is licensed under MIT, and its content is licensed under CC BY-SA 4.0 unless explicitly stated otherwise. Third-party libraries included in this repository may be subject to their own licenses.