Nothing is shown before you authenticate — not instance names, not incident counts.
every attempt logged · ip + device 3 failures → 15m lockout