Music Assistant stops skipping the expensive password check when a sign-in names an account that does not exist. That shortcut made unknown usernames receive a quicker response, offering a clue about which accounts were registered.
Marcel van der Veldt also moves password hashing off the main processing loop and allows only two calculations at once. This avoids briefly blocking the server for each password check and limits the processor work that simultaneous attempts can start.