HOW IT WORKS
Account access
Verified email signup, sign-in, password recovery and account controls.
Last reviewed November 2026
Creating or recovering an account
For email signup, request a verification link, open it from your mailbox and choose a password. No user or email reservation is created before the link is verified. Existing password accounts and Google sign-in continue to work. Google accounts do not acquire password-reset credentials.
Forgot password requests a one-use link for password accounts. Requests use the same generic response for known, unknown and Google identities; the mailbox receives the appropriate next step. Email entry points clearly report unavailable when the operator has not configured a verified sender.
Account controls and delivery
The account menu focuses inside its dialog, contains keyboard traversal, closes through an explicit Close action or Escape, and restores the trigger focus. Sign-out and billing portal actions prevent duplicate submissions and report failed requests instead of pretending they succeeded.
Email delivery requires the canonical APP_ORIGIN, a verified AUTH_EMAIL_FROM sender and RESEND_API_KEY in the server environment. Optional AUTH_DATABASE_PATH selects the persistent account database. These are operator settings, not browser fields. Delivery and sender-domain verification must be tested on the deployed host.
Audit detail — reproduction & protocol
Link and session protection
Account links use 256-bit random tokens stored only as SHA-256 hashes, expire after 30 minutes, and can be consumed only once by an explicit POST. Tokens travel in URL fragments with no-referrer metadata rather than query parameters. Password reset revokes all account sessions and sibling tokens and atomically rechecks credentials against an old-password login already in flight.
Requests are limited to three per address per hour, 20 per trusted network per hour and 200 globally per hour. Browser requests time out after ten seconds; the fixed Resend transport times out after eight seconds. Provider response bodies, tokens and credentials are never logged.
Research tooling, not trading advice — see the terms and privacy policy. Questions or corrections: [email protected].