Thanks for the report! This one isn't a security issue, though. Password length limits aren't secret: they're in our source code and our OpenAPI schema, and the registration form shows them too. Knowing that a password must be at least 8 characters doesn't help an attacker, and it doesn't reveal whether an account exists or anything about its password. CWE-209 covers error messages that leak sensitive details, such as stack traces or internal paths, which isn't the case here.
If the validation message reads too much like raw schema output, that's fair UX feedback and we can tidy up the wording.
If you think you've found a real vulnerability in the future, please email security@fluxer.com instead of posting it publicly, so we can look into it before the details are out in the open.
Thread
Comment by Hampus