Password reset link broken: pre-release and first 30 minutes checklists

Password reset emails link to a wrong or expired route after a routing change.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

7 pre-release items · 8 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01Request a password reset in staging, open the delivered email, follow its link, and confirm the reset form loads rather than the reset request screen. e2e
PR-02Complete a password change through the emailed link and confirm sign-in works with the new password. e2e
PR-03Confirm the delivered reset email contains a full reset URL and no unreplaced template variable. e2e
PR-04Test the reset link builder with a token that contains reserved characters and confirm the query string decodes back to the same token with no HTML entities in it. unit
PR-05Render the password reset email template in a test and confirm every variable it references is supplied by the sending code. unit
PR-06Confirm the production application base URL matches the domain users reach after any host or domain move. config
PR-07In staging with the production base URL configuration loaded, request a reset email for a test account and confirm its link host responds with the reset form instead of a 404. e2e

First 30 minutes

FM-01Request a password reset on production with a test account and follow the link to see which screen or error it reaches.
FM-02Read the outgoing reset message in the mail log and check that the URL is present, correctly escaped and on the current domain.
FM-03Compare the reset flow on the previous release in the same environment to isolate the change that broke the link.
FM-04If the link host is wrong, correct the application base URL; a code rollback is not needed for that case.
FM-05If the link is malformed or missing, roll back the release that changed the reset template or the link builder.
FM-06Post a notice on the sign-in page that reset emails sent during the incident window do not work and must be requested again.
FM-07Give support staff a manual password reset path for locked-out users until the fix is live.
FM-08After the fix, send a new reset email and confirm its link opens the reset form.

Download the checklist

Pre-release checklist (Markdown)1.5 KB · v1.0.0
First 30 minutes checklist (Markdown)1.2 KB · v1.0.0

Only in this checklist

PR-04 is the only item among 6 published checklists in this group that relies on unit tests: Test the reset link builder with a token that contains reserved characters and confirm the query string decodes back to the same token with no HTML entities in it.

Questions

What should be checked before a release to prevent Password reset link broken?

7 pre-release items, PR-01 to PR-07. PR-01: Request a password reset in staging, open the delivered email, follow its link, and confirm the reset form loads rather than the reset request screen.

Is there a rollback plan for Password reset link broken?

The first-30-minutes checklist has 8 items. FM-01: Request a password reset on production with a test account and follow the link to see which screen or error it reaches.

What should a team do in the first 30 minutes after Password reset link broken is detected?

The first-30-minutes checklist has 8 items. FM-01: Request a password reset on production with a test account and follow the link to see which screen or error it reaches.

Which configuration checks apply to Password reset link broken?

PR-06: Confirm the production application base URL matches the domain users reach after any host or domain move.

Is a Password reset link broken checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: end-to-end tests, unit tests and configuration and environment tests.

Which pipeline stages does the Password reset link broken checklist cover?

The pre-release items map to the pre-deploy, post-deploy and pre-merge stages.