## 28) Login failure delay can enable app-layer DoS

backend/app/utils/constants.py

@@ -45,6 +45,19 @@ SESSION_TOKEN_SIGNATURE_SEPARATOR: Final[str] = "."
 SESSION_COOKIE_NAME: Final[str] = "bangui_session"
 """Name of the session cookie used by the browser SPA."""
 
+# ---------------------------------------------------------------------------
+# Authentication penalty (brute-force resistance)
+# ---------------------------------------------------------------------------
+
+LOGIN_PENALTY_BASE_SECONDS: Final[float] = 1.0
+"""Base penalty (seconds) for a failed login attempt."""
+
+LOGIN_PENALTY_MAX_SECONDS: Final[float] = 10.0
+"""Maximum penalty (seconds) for failed login attempts."""
+
+LOGIN_PENALTY_MULTIPLIER: Final[float] = 2.0
+"""Exponential multiplier applied per failed attempt."""
+
 # ---------------------------------------------------------------------------
 # Time-range presets (used by dashboard and history endpoints)
 # ---------------------------------------------------------------------------