Forgot password - how to search for user?

[jayy]

Seems like my current privacy rules does not allow searching the User table to see if the email exists (before sending a reset password email).

What setting should I change?

Or should I not even check the User table? Just display an “Email sent” notification, whether or not the email actually exists?

[johnny]

Hey there @jayy,

Under everyone, check email. That should fix it.

[jayy]

Thanks @johnny yep that’s what I did. But i wonder if there’s any security concern about doing that?