Controls
Access control
Secure sign-in links and codes
In placeCriticalVerified 15 September 2026ST4S A11
What this control means
There are no passwords to reset. Sign-in codes and magic links are random, single-use, expire after one hour and are delivered by email only.
What we found
Sign-in codes and links are random, single-use and now expire after one hour.
How we verified it
- Confirmed codes and links are generated by Supabase Auth: random, single use, delivered by email only.
- Reduced expiry from 24 hours to 1 hour and confirmed the setting applied.
Evidence (private, draft only): kuraplan-st4s-evidence/02-access/2026-09-15-auth-config-change.txt
Questions about this control: security@kuraplan.com