We suppress some password recovery emails in the Auth send-email hook (send-email-for-auth-action) to reduce signup-then-immediate-reset abuse.

Rule

Skip sending a recovery email when all of these are true:

1. email_action_type is recovery
2. The account is unconfirmed (email_confirmed_at is empty). Only this Auth field is trusted; never user_metadata.email_verified.
3. The account was created less than one hour ago

In that case the hook still returns HTTP 200 to GoTrue (so the app keeps the usual “check your email” response and does not reveal whether an account exists), but Resend is not called. Logs use auth_email_recovery_suppressed with recipient domain only.

What still works

• Confirmed accounts can request a reset immediately
• Unconfirmed accounts older than one hour can still get recovery mail (for people who signed up, got distracted, and came back later)
• Signup confirmation emails are unchanged

Why

Attackers were signing up with third-party emails, then requesting a password reset within seconds. Victims received both a Peels verify email and a reset email for accounts they never created. That hurts sender reputation and confuses strangers. See <page url="https://app.notion.com/p/2c7b37e1678f80568c72d11f79e06a99">Security</page>.

Related

Forgot-password also uses Cloudflare Turnstile (same as sign-up). That slows automated form abuse but does not replace this hook rule. Details: <page url="https://app.notion.com/p/2c7b37e1678f80dc9adae36d39c7dc88">Cloudflare Turnstile Implementation</page>.