I run a short checklist before I let anyone near a new build. Security stuff, mostly, boring on purpose. I'd already spent a chunk of the week finding and fixing real problems, and this pass was supposed to be the easy lap: confirm it all still works, then ship.
I typed my password wrong a few times on purpose to check the login limiter kicked in. It did. Good. Next I went to test password reset, expecting to start from scratch.
It was already locked. On the very first try. I hadn't touched that feature at all.
I waited, tried the sequence again, and got the same result. In my setup, unrelated actions were sharing the same limit. I'd tested them separately before, which was why I'd missed what happened when I used them together.
Someone who couldn't remember their password would reach for reset and find that blocked too. They wouldn't know anything about my checklist or why the app was asking them to wait. They'd just know that the obvious way back in didn't work.
I changed how I applied the limits, deployed the fix, and ran the test again: deliberately failed login, then went straight to password reset. This time it worked.
The individual checks had both passed. It took trying them in the order a person might actually need them to find the problem.
