ssh git@host web login mints a login link (5-minute, single use) without checking the 5-per-hour login-link limit that the web form enforces (internal/control/web.go, runWebLogin; the limit is in RequestLoginLink, internal/control/loginlink.go). The caller is already authenticated by key, so the impact is low, but the comment in loginlink.go says the counter is shared and it is not enforced on this path.
- Apply the same per-account limit in
runWebLogin, or correct the comment.
referenced in commit 4e0958a163 by cmc: plans: open issues from the architecture and UX reviews
2026-09-28 05:43 UTC