I had GPT-5.5 Thinking read through the sizuq security design done by Claude Code Opus 4.7. Then I took the feedback it returned and threw it back to Claude.
Here’s what Claude had to say:
Reviewer’s misreading: it says “recovery codes are stored in plaintext,” but that’s already implemented with SHA-256 hash storage (hashRecoveryCode in src/lib/totp.ts, plus codes.map(hashRecoveryCode) in enable/route.ts). Verification also consumes them via hash comparison. This looks like the reviewer guessed without actually reading the code.
Patch urgently: remove allowDangerousEmailAccountLinking: true. Automatically linking to a Credentials account with the same email really is dangerous. Revert to the default (disabled) and switch to a flow that links explicitly from /settings/accounts with re-authentication.