password reset and salt

I am writing this to find more information about keybase and the authentication process. I have recently become aware of getsalt.json which displays "what I only assume" is the salt used in scrypt to hash the users supplied password. It became a concern only after attempting to reset my password and further identifying the salt does not change per requested password reset.

I would recommend this process produce a unique salt per requested "password reset" once the user has visited the site via the provided link to their inbox.

I would also like to suggest the password reset link to exist for only one attempt at resetting the end users password as this was attempted many times over the course of the reset links life. Ideally the reset link should be invalidated after the user has successfully reset their password preventing any potential compromised Email account from becoming a race condition.

Additional concerns are the end user can submit the exact same password, using the same salt, to generate the same hash as previously used.

Thank you for your time in this matter and providing a great service.

Start by tracing the password-reset flow and the getsalt.json output described in the report. Determine how reset links, salts, and repeated password submissions are handled; done would require an agreed security design and verification that reset links are single-use and password-reset salts are handled safely.