Go Tenant Password Reset Emails: Template Design and Evidence Retention in 2026

·2 views

The article argues that a property-management password reset email should rely on one application-owned recovery template paired with a separate audit record, avoiding duplicate stored email bodies that cost extra storage. It proposes that the email identify the service, state the requested action, include a controlled recovery link, explain validity and single-use behavior, and direct unrecognized requesters to support. The author stresses that these are application requirements rather than fields mandated by an email standard. Delivery events and template versions should be retained as evidence, while the usable recovery secret must be excluded from that evidence. The piece also notes that compliance notice service rules must be determined separately, and that the recovery email should never contain a password or ask recipients to send one.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Disabling SSH Password Login May Not Work: Cloud-init Drop-in Overrides Config

A recent OpenSSH security advisory from Alpine Linux, which reached the top of Hacker News, prompted many administrators to question whether password authentication is really disabled on their servers. The author audited seven VPS instances and found that three still accepted password logins, despite having edited sshd_config long before. The cause was a drop-in file created by cloud-init, which sets PasswordAuthentication to yes and is read before any directives added later in the main file. Because sshd uses the first value it reads, the author's later 'no' setting was silently ignored. The article recommends checking the effective configuration with sshd -T and verifying from outside the server by probing which authentication methods it advertises, and it includes a Python script for auditing multiple hosts without sending any credentials.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Running Vercel cron more than daily on the Hobby plan via an external scheduler

Vercel's Hobby plan limits cron jobs to once per day, and a schedule like */15 * * * * causes deploys to fail. Vercel also notes that Hobby jobs run at some point within the set hour rather than at an exact time. The recommended workaround is to place the job logic in an API route protected by a bearer token stored in CRON_SECRET, then have an external scheduler call that route over HTTP on any desired schedule. The article also advises removing the route's crons entry so deploys stop failing, and notes that each call still counts toward Vercel usage. The author, who works on the scheduler RunLater, promotes it as one option alongside free built-in daily cron for simpler needs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

JSLab adds npm package install, type support, and quick fixes for missing imports

JSLab, a JavaScript and TypeScript scratchpad for macOS, lets users open a package sheet with ⌘I to search the npm registry and add packages by name or exact version. Installed packages are shared across all tabs, so an import added in one tab works in others without a restart, and the editor reads their types for autocomplete and type-checking. When an import is missing, the editor flags it with a quick fix to install the package, and browser tabs show an install button that reruns the code once installation finishes. The sheet also tracks installed and latest versions with update and removal options, while install scripts are blocked by default and JSLab uses its own .npmrc file for registry settings. JSLab is set to launch on November 15.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Perché du e il Finder mostrano dimensioni diverse per la stessa cartella

Lo stesso percorso può risultare con dimensioni diverse in du -sh e nel Finder perché misurano aspetti differenti: la lunghezza dei file oppure lo spazio effettivamente occupato sul disco. Quando il disco si riempie conta soprattutto il secondo valore, e calcolarlo correttamente va oltre la semplice somma di st_size. I file piccoli occupano comunque un blocco intero, mentre i file sparsi riservano una lunghezza elevata usando blocchi solo per le parti scritte. Per evitare conteggi errati, lo scanner descritto non segue i collegamenti simbolici, non attraversa i dischi montati e conta una sola volta gli hard link. I cloni APFS restano il caso più difficile, perché condividono blocchi con l'originale e il conteggio basato sui blocchi può sovrastimare lo spazio recuperabile.

0 comments Read more at DEV Community