The login handler below returns a different, specific error message depending on whether the email exists or the password was wrong.
The bug: "No account found with this email" vs "Incorrect password" lets an attacker enumerate every valid email address in the system by trying each one and watching which error comes back — a huge head start for credential-stuffing and phishing.
Your task: fix solve(emailExists, passwordCorrect) so both failure cases return the exact same generic message, 'Invalid email or password.' — only the success case is distinguishable.
Sample tests