Auth error messages do not reveal whether email exists

Distinct error messages for 'email not found' versus 'wrong password' allow automated enumeration of every registered email address on your platform (CWE-204, CWE-203, CAPEC-196). The same applies to password reset endpoints that return 404 for unregistered emails. OWASP A07 covers this as an authentication information disclosure failure. Beyond security, leaking account existence violates user privacy — subscribers who registered with a personal email may not want their account existence confirmed to anyone who asks. A uniform response eliminates both the security and privacy exposure at zero cost.

Return identical status codes and message text regardless of whether the email exists:

// Unified response — same message for missing email and wrong password
const user = await db.user.findUnique({ where: { email } })
if (!user || !(await bcrypt.compare(password, user.passwordHash))) {
  return Response.json({ error: 'Invalid email or password' }, { status: 401 })
}

// Password reset: fire-and-forget, always return the same message
await sendResetEmailIfExists(email)
return Response.json({
  message: 'If this email is registered, you will receive a reset link shortly.'
})

Also normalize response time: a fast path (user not found, no hash compare) reveals account absence through timing. Add a constant-time delay or perform a dummy bcrypt compare even when the user does not exist.