On 11.: also prevent leaking the account’s existence when someone requests a password reset. Otherwise it’s a great way of finding out who has accounts where if

On 11.: also prevent leaking the account’s existence when someone requests a password reset. Otherwise it’s a great way of finding out who has accounts where if you know their email. Use the same text as receipt to the user after form submission. You can, and probably should, go one step further and serve the same HTTP-response (size in bytes and response time) as well.