portswigger 4 Broken brute-force protection, IP block ( Auth Lab 4) Mar 2, 2026 Username enumeration via response timing ( Auth Lab 3 ) Feb 4, 2026 Username enumeration via subtly different responses ( Auth Lab 2 ) Feb 3, 2026 Username enumeration via different responses ( Auth Lab 1) Feb 2, 2026