The form never fakes a confirm flag

Confirm only runs after a valid hashed code. A bad code does not mint the confirm flag.

Kumir never invents a successful verified stamp. POST /api/auth/verify and POST /api/v1/auth/verify only set User.emailVerifiedAt after a valid hashed code.

A failed or expired code does not mint emailVerifiedAt.

Verify email form Open related page Log in