Account security
Correct recovery request
Invalid input exposes no account state.
Send recovery link
The application owns rate limits, account discovery protection, tokens, delivery, and expiry.
Enter a valid email address
Recovery was not requested and no account information was disclosed.