Security — Signing in

• Sign-in links: Signing up asks for an email address and no password, so an emailed link is the ordinary way in rather than a recovery path — and it is held to everything a password is. The token is 256 bits of cryptographic randomness, stored only as a hash, valid for 30 minutes, compared in constant time, and spent on first use: redeeming it clears it whether or not it had already expired, so a replayed link is dead either way. Requesting one returns the same confirmation for an address that exists and one that doesn't, which stops the form being used to test whether somebody has an account. • What a link does not bypass: Single sign-on requirements and two-factor are re-checked after the token is spent and before any session cookie exists. A workspace that mandates SSO or two-factor cannot have that requirement sidestepped by asking for a sign-in link, which is the obvious attack on passwordless authentication and the reason the checks sit where they do rather than at the password prompt.