The reset link works more than once and never expires Fix before launch Seen in password reset flows in the evidence library A forwarded or leaked email can be used to take over the account. Fix Single-use links that expire, and a notice when the password changes.
The reset link works more than once and never expires Fix before launch Seen in password reset flows in the evidence library A forwarded or leaked email can be used to take over the account. Fix Single-use links that expire, and a notice when the password changes.
No way back if the second factor is lost Fix soon Seen in two-factor flows in the evidence library Locked-out customers flood support or leave. Fix Recovery codes at setup, and a clear recovery path.
Changing email does not confirm the old address Fix soon Seen in account settings flows in the evidence library Someone with brief access can take the account for good. Fix Confirm on both addresses before the change applies.