Email Validation and Verification in Identity Systems Cheat Sheet

[jeremyrayjewell]

Problem Statement:
Developers frequently mis-handle email validation, canonicalization, and verification flows in identity systems, leading to account takeover and enumeration risks.

Why This Needs Its Own Cheat Sheet:
Authentication CS is large.
Input Validation CS does not address identity specific email handling risks.

Proposed Scope:
Email format validation pitfalls
Canonicalization and normalization
Unicode and IDN concerns
Case sensitivity handling
Email ownership verification flows
Password reset threat model
Email change workflows
Anti enumeration controls
Temporary email abuse
Email as weak factor risks

[jeremyrayjewell]

Requesting NEW_CS label for this proposal. Thank you.

[mackowski]

@jeremyrayjewell this is great idea!
@jmanico @szh what do you think, should we have new cheatsheet or adjust Authentication CS?

Also question to all, if we go with new CS, do we see other cheatsheets that should reference this new one?

[jmanico]

I vote new cheatsheet! :)