Aug 26 - Enhance security 4

app/templates/auth/login.html

@@ -7,8 +7,13 @@ block body_class %}auth-page{% endblock %} {% block body %}
       <span class="logo-text">PassKeeper</span>
     </div>
 
+    <!-- Deliberately non-committal: the server returns the same response whether
+         or not the address was already registered, so that registration cannot
+         be used to probe which addresses have PassKeeper accounts. Asserting
+         "account created" here would leak what the API withholds. -->
     <p id="register-notice" class="notice-success hidden">
-      Account created! Please sign in.
+      If that email address was available, your account has been created — please sign in below.
+      Already had an account? Sign in with your existing master password.
     </p>
 
     <!-- Step 1: Email + Master Password -->