A synthesis of secure token generation, constant-time comparison, rate limiting, and PHP's type system applied to the one feature that, when broken, can hand over an account.
Every PHP course teaches these concepts in isolation: "use random_bytes() for tokens," "use hash_equals() for comparisons," "rate limit your endpoints," "watch out for type juggling with ==." They're presented as separate lessons, separate quiz questions, separate checklist items.
Then a developer sits down to build "forgot password," combines all four incorrectly, and ships an account takeover vulnerability that passes code review because each individual line looks fine.
Password reset is the perfect case study because it's small enough to fit in one article and high-stakes enough that every shortcut has a name and a CVE history. Almost every step in the flow has a security failure mode. Let's break it seven different ways before we get it right — then look at how much of this Laravel already solves for you, and where it doesn't.
The flow, in theory
