Skip to main content

FR-01.10 — Forgot Password

Trigger: A user requests password recovery without being authenticated.

System shall:

  • Accept the recovery request.
  • Generate a secure, time-limited password-reset mechanism.
  • Send the reset mechanism to the user's registered email.
  • Prevent the mechanism from exposing the existing password.

Acceptance Criteria:

  • PASS: A valid account receives a password-reset mechanism.
  • PASS: The reset mechanism expires after the defined period.
  • PASS: The existing password is never exposed.
  • FAIL: An expired reset mechanism can be used.