From e8b4907dfb11881ba4867dd6d1250e66bea9d14b Mon Sep 17 00:00:00 2001
From: Frank Elsinga <frank@elsinga.de>
Date: Sun, 18 Jan 2026 17:46:53 +0100
Subject: [PATCH] Apply suggestions from code review

---
 server/password-util.js | 2 +-
 src/lang/en.json        | 1 +
 src/pages/Setup.vue     | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/password-util.js b/server/password-util.js
index e5ba8998c..17e2e8413 100644
--- a/server/password-util.js
+++ b/server/password-util.js
@@ -79,7 +79,7 @@ async function validatePassword(password, checkBreached = false) {
         if (breachResult.breached) {
             return {
                 ok: true,
-                warning: `This password has been found ${breachResult.count.toLocaleString()} times in data breaches. Consider using a different password.`
+                warning: {msg: "passwordFoundInDataBreach", meta: breachResult.count}
             };
         }
     }
diff --git a/src/lang/en.json b/src/lang/en.json
index 317ab1a55..ce4f39c99 100644
--- a/src/lang/en.json
+++ b/src/lang/en.json
@@ -1365,6 +1365,7 @@
     "Details": "Details",
     "passwordTooShort": "Password must be at least 12 characters long.",
     "passwordWeakWarning": "This password may be easy to guess. Consider using a longer or more unique password.",
+    "passwordFoundInDataBreach": "This password has appeared in a known data breach (via Have I Been Pwned). Please choose a different password. | This password has appeared {n} times in known data breaches (via Have I Been Pwned). Please choose a different password.",
     "TLS Alerts": "TLS Alerts",
     "Expected TLS Alert": "Expected TLS Alert",
     "None (Successful Connection)": "None (Successful Connection)",
diff --git a/src/pages/Setup.vue b/src/pages/Setup.vue
index 7e3ec4866..07b59e29d 100644
--- a/src/pages/Setup.vue
+++ b/src/pages/Setup.vue
@@ -120,7 +120,7 @@ export default {
 
                 // Show warning toast if password was found in breach database
                 if (res.ok && res.warning) {
-                    this.$root.toastWarning(res.warning);
+                    this.$root.toastWarning(res.warning.msg, res.warning.meta);
                 }
 
                 if (res.ok) {