rateLimiter.recordFailure(null, "192.168.1.8");
        assertTrue(rateLimiter.checkAttempt("realuser", "192.168.1.8"), "Should still track IP");
    }

    @Test
    public void testNullIp() throws Exception {
        // Null IP should be handled gracefully
        assertTrue(rateLimiter.checkAttempt("user1", null), "Null IP should be allowed");

        // Should not affect account limiting