Account lockout is implemented after failed attempts

IP-based rate limiting alone does not stop a targeted attack on a specific account from a botnet that uses one password attempt per IP address. CWE-307 and NIST 800-63B §5.2.2 require per-account throttling in addition to per-IP limits. PCI-DSS Req-8.3.4 requires temporary lockout after no more than 10 consecutive failures. OWASP A07 lists credential stuffing and brute-force susceptibility as named failure modes. Supabase Auth provides endpoint rate limiting but does not implement configurable per-account lockout — custom lockout logic is required unless you use Clerk or Auth0 with Attack Protection enabled.

Track failed attempts on the user record and lock the account temporarily after exceeding the threshold:

async function recordFailedAttempt(userId: string) {
  const user = await db.user.update({
    where: { id: userId },
    data: {
      failedLoginAttempts: { increment: 1 },
      lastFailedLoginAt: new Date()
    }
  })
  if (user.failedLoginAttempts >= 5) {
    await db.user.update({
      where: { id: userId },
      data: { lockedUntil: new Date(Date.now() + 15 * 60 * 1000) }
    })
    await sendLockoutEmail(user.email)
  }
}

Check lockedUntil at the start of the login handler, before the password comparison. Reset the counter to zero on a successful login.