TIL there’s a built-in validation rule in Laravel to check if passwords were leaked via HIBP. Here’s how Password::uncompromised() works and how to use it.