> Microsoft scans to check the website contains malware. IMHO the security blunder is a self-implemented magic link. It's not self-implemented, you can check i

> Microsoft scans to check the website contains malware. IMHO the security blunder is a self-implemented magic link. It's not self-implemented, you can check it out here: https://github.com/supabase/gotrue https://github.com/supabase/gotrue > Not password protected if the password is part of the URL. It's a token that's valid for a couple of minutes – just like a password reset token. Indeed, in the given implementation, it's the very same as the password reset token. If you consider this implementation as "not password protected", any website with a password reset functionality is "not password protected".