Reviews the code that lets someone back into an account before you merge - forgot password and reset routes, magic link and one-time code sign-in, email change and verification, password change, two-factor reset and recovery codes, and support resets: can someone who is not the owner end up holding the account, what does the flow reveal and send in bulk, and what is cut off when the account changes hands. Catches non-cryptographic or short tokens, codes with no attempt limit, plain-text or reusable tokens, reset links built from the Host header, accounts taken from the request instead of the token, unconfirmed email changes, two-factor dropped by a reset, enumeration and sessions left alive, then gives the smallest code that closes each path and what to check if it is already live.