Audit my in-app password change flow (the one in account settings, not the reset flow). Fix it to meet these requirements. Require the user to enter their current password before setting a new one, so a stolen session or an unlocked laptop can't silently change it. Apply the same password policy as signup to the new password. Rate limit the current-password check the same way as login, since it's an online guessing oracle. On success, send a notification email to the account address saying the password was changed, with a link to the reset flow in case it wasn't them. Never return whether the current password was correct in any way that differs beyond the success/failure of the change itself. Do not change the settings page layout beyond adding the current-password field. Do not require the current password if the account has none (social-login-only accounts setting their first password); handle that case explicitly. Show me the flow before and after. Give me a verification pass: a change with a wrong current password (refused and rate limited after repeats), a successful change, the notification email arriving, and confirmation the old password no longer signs in.