new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Authentication · all subjects

email & password: email verification

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Email OTP verification no longer reveals email registration status

The email OTP verification check no longer reveals whether an email is registered before the OTP itself is verified, improving account enumeration security.

Origin header validation on magic-link and email-OTP endpoints

The magic-link (/sign-in/magic-link) and email-OTP (/email-otp/send-verification-otp) send endpoints now force-validate the request Origin on all requests including cookieless requests to match the built-in /sign-in/email and /sign-up/email routes. A cookieless cross-origin POST can no longer trigger a magic-link or verification-OTP email to an arbitrary address. Cookieless requests carrying no Origin (server-to-server) are unaffected.

Email OTP prevents concurrent redemption

Submitting the same email OTP from several requests at once can no longer sign in more than once or gain extra tries beyond the attempt limit.

Email verification type passed to custom OTP on sign-up

The email verification type is now passed to custom OTP generators after email sign-up.

Verification email constant-time response floor

The unauthenticated /send-verification-email path now enforces a constant-time floor (500 ms) so that the response duration does not reveal whether the email belongs to a real unverified user.

Invalid verification email handling

sendVerificationEmail is now awaited so failures surface to the client with the correct status code instead of being caught and logged.

Give your agent this brain