code: public function onBadCredentials(User $user, AuthenticationException $exception): AuthenticationException
      {
          --$user->loginCount;
  
          if ($user->loginCount > 0) {
              $user->save();
  
              return new BadCredentialsException(
                  sprintf('Invalid password submitted for username "%s"', $user->username),
                  $exception->getCode(),
                  $exception
              );
          }
  
          $user->locked = time() + $this->options['lock_period'];
          $user->loginCount = $this->options['login_attempts'];
          $user->save();
  
          $lockedSeconds = $user->locked - time();
          $lockedMinutes = (int) ceil($lockedSeconds / 60);
  
          $exception = new LockedException(
              $lockedSeconds,
              sprintf('User "%s" has been locked for %s minutes', $user->username, $lockedMinutes),
              0,
              $exception
          );
  
          $exception->setUser($user);
  
          return $exception;
      }
docs: Counts the login attempts and locks the user if it reaches zero.