Audit my magic link (passwordless email) login flow for weaknesses. Look at token generation, storage, expiry, and consumption. Apply these requirements: tokens are generated with a cryptographically secure random source with enough entropy (at least 128 bits); they're single-use and expire quickly (15 minutes is standard); requesting a new link invalidates previous unused ones; the request endpoint is rate limited per email and per IP so it can't be used to spam someone's inbox; the response never reveals whether the email is registered; and where practical, the link is bound to the requesting browser (a cookie set at request time checked at consumption) so a link forwarded or intercepted elsewhere doesn't work. After successful login, issue a proper session with the same protections as password login. Do not change the user experience of the flow; keep the same emails and pages. Use the existing email sending code. Show me each gap found and the fix. Give me a verification pass: request a link, use it, confirm reuse fails; request a second link and confirm the first is dead; hammer the request endpoint and confirm rate limiting engages.