- Shipped
- September 23, 2026 at 10:14 PM UTC
- Author
- Kamo
- Commit
- 99a97ee
Forgot-password resets go to the address on the user account, usually a personal one, but members type the work address their organization gave them. SecurityService now recognises a work address and answers 409 WORK_EMAIL with personalEmailHint, the account address masked. Nothing is sent. The wizard shows that in place of "check your inbox": the address they typed, the masked hint on a line of its own, and the field cleared, relabelled "Personal email address", focused, with the hint as its placeholder. The *** stays solved, since the member is being helped along rather than refused. Entering the personal address carries on to the code step as before. /recover's email step shows the same answer as an info message instead of "Failed to send recovery email".