Checks · AUTH-008

AUTH-008 · Password reset token predictable or without expiry

Why it matters

A guessable or permanent reset token lets someone else take the account.

How we detect it

Reset tokens come from Math.random or have no expiry.

How we fix it

Use a cryptographic random token and a short lifetime.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles