How would you design a secure password reset flow?

A reset token is a temporary credential, so its lifetime, storage, and use are tightly bounded. I store only a hash, invalidate older reset records when appropriate, and consume the valid record atomically with the password change so concurrent submissions cannot both succeed. Rate limits protect both request and verification paths without revealing account existence. After a security-sensitive reset, session revocation and user notification follow the account-risk policy, while logs contain no raw token.