Urgent.News

What's breaking now, across thousands of outlets.

More in Tech

The Password Reset Flow: Where Good PHP & Laravel Developers Ship Bad Security

A synthesis of secure token generation, constant-time comparison, rate limiting, and PHP's type system applied to the one feature that, when broken, can hand over an account.

  • Use cryptographically secure token generation (bin2hex(randombytes(32)))
  • Hash tokens before storing in database (SHA-256)
  • Compare tokens using constant-time comparison (hashequals())

2026.37: Duo Threats

The best Stratechery content from the week of September 7, 2026, including the arrival of the Duo, AI that benefits humanity, and closing the book on a catastrophe.

More from Friday 11 September →