2024-03-26 UTC
# 
[aciccarello] "Capability URLs should expire. For example, it may be suitable to have a capability URL that can only be accessed once, or one that expires after a week. Password reset links should expire after the password has been successfully changed, or when the email address on the account changes."