There's possibly the small exclamation mark﹗

www.compart.com/en/unicode/U...

NIST recommends doing this (pages.nist.gov/800-63-4/sp8...; they've changed their stance over time though: pages.nist.gov/800-63-3/sp8...), and checking against Pwned Passwords it might (theoretically at least) make a difference.

(oh and you were replying to the part about making it even worse? 😅)

Admins of what? The potential inadvertent spammer? 🤣

You can add comments to commits, if you want to notify someone, that's where you can do it, in a much more explicit way: it's a comment, it works like other comments. Commit messages are more like commit content than like comments.

And by that reasoning, should GitHub also notify people you mention in code (including markdown files) in your commit?

If I write about @Inject or @Nullable java annotations in a commit message and GitHub notifies/spams users named inject or nullable, that's a bug, not a feature.
It'd work (maybe) on-premise or scoped to org members or project contributors, but not at github's full scale.

Should have never been a thing if you ask me.

winter is coming

You think you want (or are ok with / could live with) the constraints of the framework (because you think you'll go much faster) until you realize they prevent you from doing what you need to (or slow you down so much that you just lost all the speed you initially got).

We have similar content in our knowledge base at work directed towards managers/sales so they don't promise/sell "just a login page" to our clients, but understand the complexity of authentication.

(we also have other docs for our developers to help them implement things "correctly", i.e. securely)

Fwiw, I wrote this a couple years ago as a reaction to blog posts I was seeing every other week: blog.ltgt.net/beyond-the-l...