Skip to content
skillsafebeta
← Report library
Purpose / Other

Email And Password Best Practices Skill Security Audit

What the author says it does (original text)

Configure email verification, implement password reset flows, set password policies, and customise hashing algorithms for Better Auth email/password authentication. Use when users need to set up login, sign-in, sign-up, credential authentication, or password security with Better Auth.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
High risk

Migration command executes an unpinned remote npm package

Source references: 1
What we found

The quick start instructs users to run `npx auth@latest migrate`. `@latest` selects whatever version is current at execution time rather than a reviewed, locked version, and npx may download and execute it.

Why this matters

If the upstream release is compromised, the package name resolves unexpectedly, or a newer version changes behavior, code can run with the developer's permissions. The migration may also alter the authentication database schema and cause compatibility or availability problems.

This command both selects the unpinned `@latest` release and invokes `migrate`. When npx needs to fetch the package, a newly published remote version can execute in the user's environment and may change the authentication database schema. The source provides no version verification, migration preview, or rollback guidance. Users can require a pinned version, release-integrity information, and a reviewed migration plan with a backup.

SKILL.md:11In the instructionsOpen original file
3. Add `sendResetPassword` for password reset flows4. Run `npx auth@latest migrate`5. Verify: attempt sign-up and confirm verification email triggers
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Password-reset event writes the user's email address to application logs

Source references: 2
What we found

After a successful password reset, the example interpolates the full user email address into a console log. Production logs are commonly centralized and retained.

Why this matters

People or logging services with access can learn which email addresses have accounts and when password resets occurred. This expands personal-data exposure and can assist targeted phishing.

This is an optional event-hook example and does not run merely from reading the Skill. If copied and enabled, however, it writes the full email address to the console after every successful reset. Centralized or long-lived production logs would broaden access to and retention of personal data. Users can ask the author to omit or redact the field by default and restrict log access, retention, and export.

SKILL.md:87In the instructionsOpen original file
    // Optional event hook    onPasswordReset: async ({ user }, request) => {      // your logic here      console.log(`Password for user ${user.email} has been reset.`);    },  },
Show 1 other places
SKILL.md:86In the instructionsOpen original file
    },    // Optional event hook    onPasswordReset: async ({ user }, request) => {      // your logic here      console.log(`Password for user ${user.email} has been reset.`);    },  },
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

Detached password-reset email work may be terminated early

Source references: 2
What we found

The example discards the email Promise with `void sendEmail(...)`, so the callback returns before delivery succeeds or fails. The later serverless advice can wait only for a Promise supplied to its handler; this example does not pass the email Promise to it.

Why this matters

A serverless runtime that freezes work after the request may never send the reset email. Delivery failures also cannot be handled reliably by this callback, potentially preventing users from recovering their accounts.

The reset callback starts email delivery with `void` and can return immediately, so it neither waits for nor propagates delivery failure. On serverless platforms that may freeze the process, delivery may not finish. Although a later section recommends a `waitUntil`-style handler, the example neither returns the email Promise nor explicitly passes it to that handler. Users can ask the author to show how these pieces are connected and test completion and failure handling on the deployment platform.

SKILL.md:79In the instructionsOpen original file
    // Custom email sending function to send reset-password email    sendResetPassword: async ({ user, url, token }, request) => {      void sendEmail({        to: user.email,        subject: "Reset your password",        text: `Click the link to reset your password: ${url}`,      });    },    // Optional event hook
Show 1 other places
SKILL.md:99In the instructionsOpen original file
On serverless platforms, configure a background task handler:```tsexport const auth = betterAuth({  advanced: {    backgroundTasks: {      handler: (promise) => {        // Use platform-specific methods like waitUntil        waitUntil(promise);      },    },
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The quick start explicitly instructs users to run an npx command with `@latest`. If the package is not already local, npx may download and execute whatever version is latest at that time, so the code run later may differ from what was reviewed and will perform a database migration. Users can ask for a tested pinned version plus backup/preview steps, or restrict execution to the lockfile-installed local CLI.

SKILL.md:11In the instructionsOpen original file
3. Add `sendResetPassword` for password reset flows4. Run `npx auth@latest migrate`5. Verify: attempt sign-up and confirm verification email triggers
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill configures verification-email delivery, but only requireEmailVerification blocks unverified users from signing in; sending a verification email alone does not enforce verification.

View source
SKILL.md:41In the instructionsOpen original file
For stricter security, enable `emailAndPassword.requireEmailVerification` to block sign-in until the user verifies their email. When enabled, unverified users will receive a new verification email on each sign-in attempt.
SKILL.md:44In the instructionsOpen original file
```tsexport const auth = betterAuth({  emailAndPassword: {    requireEmailVerification: true,  },});```

Password-reset tokens expire after one hour by default and are deleted after successful use; revoking existing sessions is a separately enabled option.

View source
SKILL.md:116In the instructionsOpen original file
Tokens expire after 1 hour by default. Configure with `resetPasswordTokenExpiresIn` (in seconds):
SKILL.md:127In the instructionsOpen original file
Tokens are single-use — deleted immediately after successful reset.
SKILL.md:131In the instructionsOpen original file
Enable `revokeSessionsOnPasswordReset` to invalidate all existing sessions on password reset:```tsexport const auth = betterAuth({  emailAndPassword: {    enabled: true,    revokeSessionsOnPasswordReset: true,  },

The Skill supports replacing the password-hashing algorithm and explicitly warns that a direct switch makes old password hashes unusable, requiring a migration strategy for existing systems.

View source
SKILL.md:186In the instructionsOpen original file
To use Argon2id or another algorithm, provide custom `hash` and `verify` functions:
SKILL.md:212In the instructionsOpen original file
**Note**: If you switch hashing algorithms on an existing system, users with passwords hashed using the old algorithm won't be able to sign in. Plan a migration strategy if needed.
Start here · InstructionsSKILL.md
email-and-password-best-practices
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Install extra software packages
SKILL.md:11In the instructionsOpen original file
3. Add `sendResetPassword` for password reset flows4. Run `npx auth@latest migrate`5. Verify: attempt sign-up and confirm verification email triggers
Connect to websites
SKILL.md:59In the instructionsOpen original file
Always use absolute URLs (including the origin) for callback URLs in sign-up and sign-in requests. This prevents Better Auth from needing to infer the origin, which can cause issues when your backend and frontend are on different domains.
SKILL.md:63In the instructionsOpen original file
const { data, error } = await authClient.signUp.email({  callbackURL: "https://example.com/callback", // absolute URL with origin});
SKILL.md:164In the instructionsOpen original file
    email: "john.doe@example.com", // required    redirectTo: "https://example.com/reset-password",  },
Lines read
213
File checksum (to compare versions)
0c861912c7349f700f2f8eb23f613cf28c2e6b7031f77645770b556bc2211d53