// Should not affect IP limiting
        rateLimiter.recordFailure(null, "192.168.1.8");
        assertTrue(rateLimiter.checkAttempt("realuser", "192.168.1.8"), "Should still track IP");
    }

    @Test
    public void testNullIp() throws Exception {
        // Null IP should be handled gracefully