Login recovery: use the protected password-reset workflow supplied with your deployment. Never expose a fallback password or recovery code on a public-facing page.