// Stricter than the global default: bounds brute-force/credential-stuffing
// attempts against any endpoint that verifies a password or MFA code
// (login, refresh, MFA verify, change-password, MFA disable).
export const SENSITIVE_ACTION_THROTTLE = { default: { limit: 10, ttl: 60000 } };