# Password reset link broken: pre-release checklist

Source: https://releasefailures.com/incidents/password-reset-link-broken/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: Password reset emails link to a wrong or expired route after a routing change.
- [ ] PR-01 Request a password reset in staging, open the delivered email, follow its link, and confirm the reset form loads rather than the reset request screen. (test class: End-to-end tests)
- [ ] PR-02 Complete a password change through the emailed link and confirm sign-in works with the new password. (test class: End-to-end tests)
- [ ] PR-03 Confirm the delivered reset email contains a full reset URL and no unreplaced template variable. (test class: End-to-end tests)
- [ ] PR-04 Test the reset link builder with a token that contains reserved characters and confirm the query string decodes back to the same token with no HTML entities in it. (test class: Unit tests)
- [ ] PR-05 Render the password reset email template in a test and confirm every variable it references is supplied by the sending code. (test class: Unit tests)
- [ ] PR-06 Confirm the production application base URL matches the domain users reach after any host or domain move. (test class: Configuration and environment tests)
- [ ] PR-07 In staging with the production base URL configuration loaded, request a reset email for a test account and confirm its link host responds with the reset form instead of a 404. (test class: End-to-end tests)