Login security

The best method is probably to modify the C source code (the console is handled in jsinteractive.c), however you could do it in JavaScript:

• Setup Serial5, and then explicitly set its pins back to read mode with digitalRead
  
• Move the console to another serial port with Serial5.setConsole
  
• Write your own handler for USB data with USB.onData, and when the correct password is entered, swap the console back.
  
  

What are you using it for that requires it to be locked down?

I haven't bothered that much with security because honestly, if someone's got the box open and can plug USB in, they could probably attach a JTAG/SWD programmer/debugger and reprogram the chip/read its contents, or could reboot it into bootloader mode.