Password recovery: Security protocol

Password reset uses hashed single-use tokens, identical responses for unknown accounts, session-family revocation on success, and throttles keyed by account hash plus network range to resist enumeration and flooding.

Published Sep 12, 2026