Force global namespace for functions which are known to be optimizable to bytecode in php, or known global functions to avoid a current namespace lookup for the function.
Add "On login; alert the user if they have a known compromised password" option (default enabled)
Add "Minimum time between triggering compromised password alerts on login" option (default 24 hours)
Ensure Haveibeenpwned API failures are logged to XF"s error log, while giving the end user a generic message. XF sanitizes password data out of the error log entries, so this is safe.