Node.js security: Use captchas and step-up verification over account lockouts

A security analysis advises against locking user accounts after failed login attempts to prevent denial-of-service attacks. Instead, it recommends implementing a captcha after several failures, followed by step-up verification via email or SMS if risks persist. The article highlights the significant data storage costs from logging credential-stuffing attacks. It suggests using aggregated metrics for common events and sampled diagnostic records for detailed investigations to manage costs.