---
title: "Verify recovery responses follow the account-enumeration policy"
description: "Compare recovery requests for owned existing and unused addresses, checking visible wording and delivery behavior against the product privacy contract."
canonical_url: "https://vostride.com/agent-library/account-recovery/unknown-email-response.md"
md_url: "https://vostride.com/agent-library/account-recovery/unknown-email-response.md"
content_kind: "recipe"
topic: "account-recovery"
---

# Verify recovery responses follow the account-enumeration policy

Compare recovery requests for owned existing and unused addresses, checking visible wording and delivery behavior against the product privacy contract.

## Risk

A recovery screen can reveal whether an address belongs to a customer. This functional recipe checks the declared visible-response policy; it does not claim to measure all timing side channels or provide a comprehensive security assessment.

## Fixtures

- An existing test-owned email account and a controlled address that has never been registered.
- Separate test inboxes for both addresses and a run-specific request correlation marker.
- Documented generic-response wording and an account lookup hook that confirms the second address is absent.

## Steps

1. Open password recovery while signed out and request a reset for the existing fixture address; record the visible confirmation text and available next actions.
2. Return to the form and request recovery for the unregistered controlled address; verify the same response class and equivalent next actions if policy requires indistinguishability.
3. Inspect the existing account inbox and verify one valid recovery message addressed only to that account.
4. Inspect the unregistered inbox and verify the documented no-mail or informational-mail behavior without assuming both products behave identically.
5. Use the account lookup hook to confirm the request did not create a new account for the unused address.

## Expected results

- Visible responses conform to the product account-enumeration policy.
- Recovery mail is routed according to the stated policy without sending an existing account reset token to the unused address.
- Requesting recovery does not implicitly register the unused address.

## False-pass traps

- Equal message text does not prove equal response timing or complete resistance to enumeration.
- An address believed unused may already exist from a previous run unless setup independently verifies absence.

## Cleanup

- Delete run-specific recovery messages and invalidate the existing account unused token.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Account recovery QA recipes](/agent-library/account-recovery.md)
- [Software factory QA library](/agent-library.md)