Every polite touch on a login or password-reset flow is also a signal an attacker reads. A tour of how helpful auth UX leaks — and why the fix is to be gloriously boring.

Or when I decided to make a blog with an (almost) full new stack and deploy it.