Group
  • Security

    Audit my password reset flow for takeover risks

    Reviews token generation, expiration, and single-use handling in your reset flow so attackers can't hijack accounts through it.

    • Improve quality
    • Debug & fix
    • Intermediate
    • General

Free Prompt

Audit my app's password reset flow for account takeover risks. Look at how reset tokens are generated, stored, and consumed. Check each of these specifically: tokens must be generated with a cryptographically secure random source (not Math.random or timestamps), stored hashed or compared in a way that doesn't leak the raw token, set to expire within a short window (30 minutes or less), invalidated after a single use, and invalidated when the user requests a new one. The reset endpoint must not reveal whether an email address exists in the system. After a successful reset, all existing sessions for that account must be revoked. Do not change the user-facing copy or email design. Do not introduce a new email provider or third-party service. Work with the email sending code already in the project. For each issue you find, show me the file and line, explain what an attacker could do with it, and apply the fix. When you're done, give me a numbered list of every change and a step-by-step way to verify each fix manually (for example: request two reset links and confirm the first one stops working).

What This Does / How This Helps

Walks your AI through the entire password reset flow and checks the parts attackers target: weak token generation, tokens that never expire, links that work more than once, and endpoints that confirm whether an email is registered. Password reset is the easiest way into someone else's account when it's built carelessly, and AI-generated reset flows regularly ship tokens made from timestamps or links that stay valid forever. One guessed or intercepted token and a stranger owns a user's account. Expect a list of findings with file references, each fixed in place, plus manual verification steps like requesting two reset links and confirming the first dies.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts