Passwordless OTP Needs Inbox Boundaries

The piece argues that email delivery is part of the authentication boundary, not just a transport layer.

Weak scoping of inboxes, sessions, and verification records can enable OTP reuse, race conditions, and ambiguous audit trails.

It recommends binding each OTP to one attempt, one user, and one nonce, with short expiry windows.

Inbox access for staging or review should also be tightly scoped to a specific run or review window.