I think most importantly, [authentication errors](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages) should be generic. Also, usernames could be made [case-insensitive](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#user-ids).
I think most importantly, authentication errors should be generic. Also, usernames could be made case-insensitive.