thoughtbot/clearance — pull request #221 by aripollak (2012-09-27 21:27:21+00:00)
Title: Don't expose the existence of a user when resetting

If an anonymous visitor submits a "reset password" request, they get a different response based on whether or not the email exists in the database. This goes against best security practices:

https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Password_Reset_Functions