January 23, 2024 - Security and Privacy

Design password recovery without revealing accounts

A password reset page can disclose whether a person has an account even when its wording looks neutral. Review responses, timing, delivery limits, reset tokens, and session handling as one customer recovery workflow.