This lesson's interactive features are locked, please to keep using them

Alerts

Alerts tell you when a monitored condition needs attention. They can come from metrics, logs, or other events. For example, you might want a Slack bot to ping your on-call engineer(s) when:

Your login failure rate exceeds 5% for more than 5 minutes
Your password reset endpoint is called 10 times in a single minute
Your "export all contacts" handler receives more than 3 invalid-password attempts in 30 minutes

When an alert fires, the on-call engineer needs to actually know what to do. They should have documentation or tools that help them:

Meaning – one sentence explaining the condition
First steps – check this dashboard, run this query, look at this log
Common causes – deployment just went out, database connection pool exhausted, third-party API down
Escalation – who to contact if the first responder can't resolve it

Keep documentation short, or even better, build it directly into your systems. If someone has to read three pages at 3 AM, it won't get read.

Assignment

Individual authentication events are useful during an investigation, but nobody should have to spot an active attack by tailing a log.

Emit structured security alerts when authentication activity crosses a threshold.

Import the provided createAuthAlertThreshold helper from "../observability/authAlerts.ts" in src/routes/auth.ts.
Create a failed login recorder named recordFailedLogin with a threshold of 3 attempts per five minutes.
Create a password-reset recorder named recordPasswordResetRequest with a threshold of 3 per ten minutes.
After the existing failed login_attempt events, call recordFailedLogin. Don't record successful logins.
After each password_reset_request event, call recordPasswordResetRequest.
Start the app.

These local counters model an alerting signal. A production deployment would aggregate events across application instances and route alerts through its monitoring system.

With Bearly Secure still running, run and submit the CLI tests from the project root.