Inconsistent recommendations around verification tokens #40
Description
The docs for password reset recommend that password reset tokens be hashed with SHA-256 before being stored.
However, the docs for email verification have no mention about hashing email verification tokens or email verification codes.
Could you please clarify whether email verification tokens/codes should also be hashed before being stored