GitSSS 1.14.0 - adaptive public login protection

Public login protection

• Adaptive local CAPTCHA for suspicious browser sign-ins without permanent account or shared-IP lockouts.
• Atomic budgets before HTTP password hashing, bounded concurrent checks and memory, and HTTP 429 / Retry-After for excessive Basic password attempts.
• Recently verified credentials still undergo password/account/MFA verification; normal Git polling does not consume shared-source budgets. Personal, OAuth and Actions tokens remain independent.
• TOTP and recovery-code budgets after password verification; image CAPTCHA consumption is serialized, arbitrary reload/revival is refused, and refresh is keyboard accessible.
• Explicit proxy-hop trust, validated right-to-left forwarding chains, direct-client scheme spoofing rejection, and configurable original HTTPS protocol headers for tunnels.
• English/Chinese guidance, offline HTML operations/configuration reference, thresholds, compatibility and rollback documentation.

Existing accounts, password hashes, SSH keys, Git/LFS objects, storage paths and database schema are unchanged. During an attack, a first-time browser login may need CAPTCHA and a first-time Basic password request may need a short retry. Counters are process-local; they reset on restart and do not provide distributed DDoS protection.

Local verification

• Backend unit packages, targeted real HTTP authentication tests and 189 frontend tests passed.
• macOS CGO SQLite / pure-Go SQLite and affected-package race checks passed.
• Actual Edge: adaptive challenges, same-NAT valid login, correct credentials and tokens under password throttling, keyboard refresh, and 58 light/dark workspace views passed.
• Ten locally built Linux/macOS/Windows binaries, XZ roundtrips, CPU architectures and SHA-256 files verified before publication.
• No GitHub Actions workflows were created or run.