Every app with a login needs a way to recover a forgotten password, and that recovery flow is, by design, a legitimate way into an account that doesn't require the original password. That's exactly why it deserves its own careful check, separate from the login form it sits next to.
What can actually go wrong here
- A reset link or code that doesn't expire, or stays valid for far longer than it needs to, giving a much wider window than intended for anyone who intercepts it.
- A reset token that's predictable or sequential, rather than a genuinely random value, making it possible to guess a valid one without ever seeing it.
- A reset flow that reveals whether a given email address has an account at all, based on subtly different responses, letting someone enumerate real users without ever resetting anything.
- A reset code with no limit on how many times it can be guessed, the same rate-limiting gap that applies to login forms applying just as much here.
- A reset link that, once used, doesn't actually invalidate itself, letting the same link work again later.
How to test your own reset flow
Trigger a password reset for a test account and look closely at the actual link or code you receive: is it long and random, or short and guessable? Try using the same reset link or code twice, does it work the second time? Try triggering a reset for an email that doesn't exist in your system at all, and compare the response to a real one, do they look identical, or does one leak information the other doesn't?
Why this flow gets less scrutiny than it deserves
Login itself gets tested constantly, simply by everyone using the app normally every day. Password reset gets used rarely, by definition, which means it gets far less real-world exposure to catch a subtle mistake, and far fewer eyes on it during ordinary testing. A flow that's used less often isn't a flow that matters less, it's a flow that's had less chance to reveal a problem on its own.
This is a short, specific list, and worth running through directly rather than assuming a feature this common was automatically built correctly. A legitimate back door into an account is exactly the kind of thing worth confirming actually requires being the account's real owner.