# Do not leak emails on password reset

**URL:** https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149
**Category:** Support
**Created:** [January 14, 2021, 9:38pm UTC](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149 "2021-01-14T21:38:54Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![awesomerobot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/awesomerobot/32/142900_2.png) [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [January 14, 2021, 9:44pm UTC](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149/2 "2021-01-14T21:44:54Z")

</div>

This is not a bug. We have a site setting called `hide email address taken` that prevents it.

There are also rate-limits on sign in so it’s not particularly easy to brute force large numbers of email addresses.

---

_[View the full topic](https://meta.discourse.org/t/do-not-leak-emails-on-password-reset/176149)._