Skills email-and-password-best-practices

📦

email-and-password-best-practices

Name: email-and-password-best-practices
Author: better-auth

Content revision r2 Low Risk ⚙️ External commands🌐 Network access

Secure Better Auth Email and Password Flows

Incomplete authentication settings can expose accounts or disrupt password recovery. This skill provides Better Auth guidance for verification, resets, policies, sessions, and hashing.

Supports: Claude Codex Code(CC)

📊 74 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "email-and-password-best-practices" from https://skillstore.io/skills/better-auth-email-and-password-best-practices.md and its manifest at https://skillstore.io/api/skills/better-auth-email-and-password-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/better-auth-email-and-password-best-practices.md Signed manifest GET /api/skills/better-auth-email-and-password-best-practices/manifest Signed lockfile GET /api/skills/better-auth-email-and-password-best-practices/lockfile

Test it

Using "email-and-password-best-practices". Create a secure email verification checklist for a new Better Auth application.

Expected outcome:

Require verified email before email and password sign-in.
Connect verification links to the approved email service.
Use an absolute callback URL on an approved application origin.
Test sign-up, delivery, expiration, and successful verification.

Using "email-and-password-best-practices". Recommend password reset safeguards for a production application.

Expected outcome:

Use short-lived, single-use reset tokens.
Return consistent responses for existing and unknown accounts.
Revoke active sessions after a successful reset.
Monitor background email delivery without logging personal data.

Using "email-and-password-best-practices". Assess changing the password hash algorithm from scrypt to Argon2id.

Expected outcome:

Existing scrypt hashes may become incompatible with the new verifier. Define and test a migration strategy before changing production authentication.

Security Audit

Low Risk

v5 • 7/23/2026 Open versioned report

The audit confirmed one medium-risk instruction that executes the latest Better Auth CLI package without version pinning. It also found a low-severity privacy risk because a reset hook logs user email addresses. The other 46 static alerts are false positives from Markdown, TypeScript examples, placeholder URLs, and ordinary API names.

Files scanned

213

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Low

SKILL.md:89

User Email Address Logged After Password Reset

The example writes user.email to application logs after reset, which may expose personal data to log readers and retention systems.

Line 89 directly interpolates user.email into console.log. The privacy impact depends on production logging controls, but the exposure pattern is explicit.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:11

Ruby/shell backtick execution

4. Run `npx @better-auth/cli@latest migrate`

The instruction runs an npm package through npx using the mutable @latest tag. Executing unpinned package code creates a supply-chain risk before a database migration.

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/better-auth-email-and-password-best-practices/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/better-auth-email-and-password-best-practices/security.svg)](https://skillstore.io/skills/better-auth-email-and-password-best-practices?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/better-auth-email-and-password-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/better-auth-email-and-password-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/better-auth-email-and-password-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

better-auth. (2026). email-and-password-best-practices security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/better-auth-email-and-password-best-practices/audits/5

BibTeX citation

@techreport{better-auth-better-auth-email-and-password-best-practices-2026,
  author = {better-auth},
  title = {email-and-password-best-practices security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/better-auth-email-and-password-best-practices/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "email-and-password-best-practices security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "better-auth"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/better-auth-email-and-password-best-practices/audits/5"
identifiers:
  - type: other
    value: "skillstore:better-auth-email-and-password-best-practices:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Launch Credential Authentication

Configure verified email sign-up, sign-in, password rules, and secure callback URLs for a Better Auth application.

Review Account Recovery

Assess reset email delivery, token expiry, anti-enumeration behavior, and session revocation before production release.

Prepare Serverless Email Tasks

Connect Better Auth background authentication emails to the deployment platform's task lifecycle.

Try These Prompts

Configure Basic Email Authentication

Configure Better Auth email and password sign-up for [application]. Require email verification, use [mail provider], and explain every required setting.

Design Password Recovery

Design a Better Auth password reset flow for [application]. Use [expiry] minutes, absolute redirects, background email delivery, and session revocation.

Audit Authentication Settings

Review this Better Auth configuration: [configuration]. Identify verification, enumeration, token, redirect, password policy, logging, and session risks. Recommend prioritized changes.

Assess Hash Migration Risk

Assess migration from [current hash] to [target hash] for [user count] accounts. Explain compatibility risks, required testing, and decisions needing external migration guidance.

Best Practices

Apply server-side validation even when client-side validation improves immediate feedback.
Keep verification and reset URLs absolute, trusted, and restricted to approved application origins.
Revoke sessions after password resets and exclude emails, passwords, and tokens from logs.

Avoid

Running mutable latest package releases without pinning and reviewing the selected version.
Logging account identifiers, passwords, or authentication tokens during verification and reset flows.
Replacing password verification without a tested migration path for existing hashes.

Frequently Asked Questions

Does this skill send authentication emails?

No. It shows where to connect your email function, but you must provide delivery, templates, retries, and monitoring.

Does it generate a complete authentication interface?

No. It focuses on Better Auth configuration and API flows, not complete forms or application screens.

Which password hash does Better Auth use by default?

The skill states that Better Auth uses native Node.js scrypt and shows an optional Argon2id configuration.

Can an existing application change hash algorithms directly?

Existing hashes may become incompatible. Plan and test a migration before changing production verification.

How long do password reset tokens remain valid?

The documented default is one hour. You can configure a shorter lifetime in seconds.

Should password resets revoke active sessions?

Yes, when your threat model requires it. The skill shows the Better Auth setting that invalidates sessions after a reset.

Developer Details

Author

better-auth

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/better-auth/skills/tree/main/better-auth/emailAndPassword/

Ref

8c3e20bba512c392d9b02ee748b18e0b09d4982c

Maintenance freshness

7/24/2026

Usage

3 downloads · 43 views

File structure

📄 SKILL.md

email-and-password-best-practices

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (1)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Launch Credential Authentication

Review Account Recovery

Prepare Serverless Email Tasks

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details