Operations / OPS-43
Sign-in lockout and rate limits: release in every region, Thursday 07:00
Description
Release of ENG-1702 on Thursday 10 September.
- 07:00 US, 07:20 UK, 07:40 EU (smallest first).
- Watch failed sign-ins, locks and 429s for an hour per region.
- Retune the WAF rules from OPS-42 once the per-account lock holds.
- Support briefed on unlocking (Confluence ENG › Runbook: credential stuffing and lockouts).
Way back: a config switch turns the lock and the per-address limit off without a deploy.
Linked issues
- relates to ENG-1702 Sign-in lockout and rate limits Done
- relates to OPS-42 Edge rate limits on the sign-in endpoints, and managed bad-address lists Done
Comments (2)
Oskar Lund · 16 Sep 2026, 08:40 UTC
Follow-up: at this morning's 06:00 shift change whole Northgate sites hit the per-address limit (failed attempts only since ENG-1716, but a site's typos add up). Raised the limit for known depot networks and allow-listed Northgate's site addresses. Config change, no deploy.
All regions out by 07:45. First morning: 23 locks, all real people who forgot their password; 4 unlocked by their administrators. WAF rules retuned at 12:00.