Finowl
Security7 min read
Account takeover prevention checklist for SaaS products
A practical account takeover prevention checklist for SaaS teams: breached-password checks, exposed email monitoring, MFA prompts, rate limiting and alerting.
6 ARTICLES
Security
Breach checks, password safety and account takeover prevention for developers.
Security6 min read
Reading a breach record: a field-by-field guide for developers
A field-by-field guide to the email breach record: DataClasses, trust flags, stealer logs, BreachDate vs AddedDate, PwnCount, and risk rules.
Security6 min read
Credential stuffing: how breached password checks cut takeovers
Credential stuffing reuses leaked logins at scale. Learn how it works and how breached email and password checks reduce account takeover risk in your app.
Security5 min read
How to block breached passwords at signup and password change
Follow NIST SP 800-63B guidance to reject breached passwords at signup and reset, with UX tips, Node and Python code, and advice on failing open or closed.
Security6 min read
Password breach checks with k-anonymity: how they stay private
How hash-prefix range lookups let you check a password against breach data without revealing it, why padding matters, and how Finowl handles passwords.
Security6 min read
How email breach checks work and what they tell you
Learn what an email breach check is, how the lookup works behind one API call, what the breach record contains, and when to run checks in your product.