There’s a few lessons one can learn from this, but I’ll add one more: password resets are disastrous.

Password resets are basically a requirement for any “serious business” but contrary to “serious security”. Perhaps the corollary is, ironically, to avoid serious businesses. There’s a certain source repo account I have for which there is no password reset web site…