I've recently stopped two design choices in external facing resources that posed significant security risks. One of which was around credentials resetting to e

I've recently stopped two design choices in external facing resources that posed significant security risks. One of which was around credentials resetting to emails that aren't stored in the API auth system itself, but rather come into Salesforce as a support case. "Don't worry, a support team member has to action the request" was meant to be reassuring, until I explained that this translated to "the only mechanism in place to prevent credentials being stolen comes with a massive social engineering vulnerability". But it's the previous choices I haven't come across yet that worry me.