Secured Application Step 2: Audit the Credentials

Confirm your application never stores a password recoverably, and that you are using the framework's hasher rather than anything hand-written. Implement or audit the reset flow against the four requirements: random long token, expiry in hours, single use, and an identical response whether or not the account exists. Then confirm changing a password invalidates other sessions, by signing in on two browsers and changing it in one. Write down what happened in the other.