Isn't sign-up still a giveaway?

It can be. Asking new users to confirm by email ('check your inbox to continue') avoids saying whether the address was already registered.

No account with that email

Your 'forgot password' page helpfully says 'No account with that email'. A competitor uses it to check which of their clients are using your app.

This answers: Is 'no account with that email' a risk? No coding needed. 2 quick decisions.

Who may see what
Keeping data safe

Checking your access…

Is 'no account with that email' a risk?

It can be. Different answers for existing and non-existing accounts let anyone test a list of emails and learn who uses your app, which is sensitive for health, dating or legal apps. Reply the same way either way, for example 'If an account exists, we've sent a link', and put the real information in the email.

Trail of the bug

Breaks at Your server: Different reply reveals who has an account

Why AI tools write this bug

AI tools write helpful, specific error messages by default, which is good UX for typos but tells strangers whether an account exists.

How to fix it

Use the same message for existing and unknown emails.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock

Common questions

Isn't sign-up still a giveaway?: It can be. Asking new users to confirm by email ('check your inbox to continue') avoids saying whether the address was already registered.

No account with that email

Your 'forgot password' page helpfully says 'No account with that email'. A competitor uses it to check which of their clients are using your app.

This answers: Is 'no account with that email' a risk? No coding needed. 2 quick decisions.

Who may see what
Keeping data safe

Sign in to walk this one

2 decisions, about 3 minutes, and a prompt to check your own app for the same problem.

Checking your access…

Is 'no account with that email' a risk?

Trail of the bug

Breaks at Your server: Different reply reveals who has an account

Why AI tools write this bug

AI tools write helpful, specific error messages by default, which is good UX for typos but tells strangers whether an account exists.

How to fix it

Use the same message for existing and unknown emails.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock

How to fix it

Use the same message for existing and unknown emails.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock

Common questions

Isn't sign-up still a giveaway?: It can be. Asking new users to confirm by email ('check your inbox to continue') avoids saying whether the address was already registered.