- Asking for a temporary password with an invalid email doesn't leak information about existing emails? - Same for login - Same for reset password