An error response that told an attacker which field was wrong

A login endpoint returning “unknown email” and “incorrect password” as separate messages, which is an account enumeration oracle with good intentions.

// what it returned
{ "errors": { "email": ["We have no account with that address."] } }

// what it returns
{ "errors": { "email": ["These credentials do not match our records."] } }

// and the timing, which is the other half:
// a missing user skipped the hash comparison and
// returned in 4ms instead of 90ms.

Fixing the message and leaving the timing achieves nothing, because the response time is a cleaner signal than the text. Hashing a dummy password when the user is missing costs ninety milliseconds on a failed login and removes the difference — and the honest note is that the timing half took a month longer to notice than the message half.