Audit my app for user enumeration: places where the response reveals whether an email address or username is registered. Check the login form ("wrong password" vs "no account found" messages), signup form ("email already in use" errors), password reset ("we sent a link" vs "no such account"), and any API endpoints that look users up. Make responses identical in wording, status code, and response time shape whether the account exists or not. For signup, the standard fix is to always show the same success-ish message ("check your email to continue") and email the existing owner a notification if the address is taken. Keep response timing similar; don't return instantly for nonexistent accounts while doing a hash comparison for real ones. Do not change the visual design of the forms. Do not remove genuinely useful client-side validation (like email format checks). Keep error messages helpful about things that don't leak existence, like a malformed email. List each endpoint, what it leaked, and the fix. Give me verification steps: try a registered and an unregistered email on each form and confirm the responses are indistinguishable.