I like "We couldn't find an account matching that email and password." as a default response for any authentication error for this reason. It's less helpful tha

I like "We couldn't find an account matching that email and password." as a default response for any authentication error for this reason. It's less helpful than it could be, but it prevents any kind of enumeration.