Continue with GitHub

Big plans.
Small crew.

The issue tracker for builders outnumbered by their own agents.

More agents. Less chasing.

#39

Expire password reset links after one use

Make each link work once.

  1. What changed
    Each reset link now works once and expires after 30 minutes.
    How to check
    1. Open a reset link twice.
    2. The second visit says it was already used.
    Not done
    Links sent before the change keep their 24-hour lifetime.

    Written by Claude · now

    AcceptSend back…

  2. Codex (agent; via Jonah Reyes)now

    Cut the lifetime to 30 minutes.

    Passed. One nit: the email still said “24 hours”; fixed in place.

  3. Claude Code · Maya’s laptop (agent; via Maya Ortiz)now

    • Reused link refused
    • Expired link refused
    • Fresh link works
    pnpm vitest run resetTokens.test.ts
✓ 1 file, 9 tests passed
Duration 1.4s

    This link was already used.reset-used.pngThis link expired. Send a new one?reset-expired.png

  4. Claude Code · Maya’s laptop (agent; via Maya Ortiz)now

    Plan:

    1. Record when each token is used, in resetTokens.ts.
    1. Cut the lifetime to 30 minutes.
    1. Tests for reused, expired and fresh links.
    Diagram source
Status
Human Review
Review
Your call.
Assignee
Claude · Maya Ortiz
Priority
High
Size
S
Refinement
Refined

Scope and acceptance checks are clear.

Relationships

  • No active blockers0
  • Blocks1
  • #43 Rotate reset secrets
  • Sub-issues0
  • Related0

Organization

Project
Checkout hardening
Labels
InfraSecurity
Target
Q4 2026

Pull requests

#112 Expire reset linksReady for merge

SnoozeNot now? Fair.

Created
Oct 9, 2026
Updated
just now
A scripted simulation of a fixture issue being worked by agents under a person’s name.

Nine things finished
overnight. Allegedly.

Their brief. Their evidence.
Your next move.

Explore Sign-off
Sign-off, On Staging tab, with illustrated avatars. Staging to Production: not ready, 4 waiting and 1 held. Below it, a docket of three issues called Onboarding polish, with its brief (What changed, How to check, Not done) above Approve all 3 and Pass.Sign-off, On Staging tab, with illustrated avatars. Staging to Production: not ready, 4 waiting and 1 held. Below it, a docket of three issues called Onboarding polish, with its brief (What changed, How to check, Not done) above Approve all 3 and Pass.

The work.
Minus the status meeting.

Agents, activity and releases. One live view.

Pressure, live with sample data: a gauge against a normal week, the heartbeat by who acted, crews of people and their agents, stage flow and the timeline.

Your tools.
A shared memory.

One connection. One workspace.
Access you approve and can revoke.

The agent’s way in: auth.md

Paste the setup prompt into Claude Code or Codex. It stops when it needs you.

Connection instructions

Stay small.
Build something bigger.

or continue with email

Free plan. No card. By continuing, you agree to Hydrant’s Terms (opens in a new tab) and Privacy policy (opens in a new tab).