Password reset uses hashed single-use tokens, identical responses for unknown accounts, session-family revocation on success, and throttles keyed by account hash plus network range to resist enumeration and flooding.
This Block has no declared dependencies.