authentication

A Password-Reset Message Should Not Reveal Who Has an Account

Design password-reset responses that help legitimate users without confirming account membership, and support the interface with secure server behaviour.