Sessions expire after 12 hours. Accounts lock for 15 minutes after 5 failed attempts.