技术问询：依据Devise文档，何时及为何发送密码变更通知邮件？

Hey there! Let's tackle these two questions about password-related notifications clearly and practically.

Password reset emails serve two core purposes: helping users regain access to their accounts and reinforcing security. Here's when you should send them:

• When a user initiates a reset request: This is the most common scenario. If someone clicks "Forgot Password" on your login page, sending a reset link (tied to their verified email) ensures only the legitimate account holder can set a new password—this prevents unauthorized people from hijacking the account by guessing emails.
• When an admin manually resets a user's password: If your support team or admin has to reset a password for a user (e.g., the user can't access their email temporarily), sending a reset notification lets the user know their password has been changed, prompting them to log in and update it to something they control.
• When suspicious activity is detected: If your system flags unusual behavior (like multiple failed login attempts from an unknown location), automatically sending a reset email can proactively protect the user's account—even if they haven't noticed the suspicious activity yet.

出于安全考虑，有时需要在用户密码变更时向其发送通知。

This notification is different from a reset request email—it's sent after the password has been successfully changed. Here are the key scenarios where this makes sense, along with why they're critical:

• User-initiated password changes: When a user updates their password in their account settings, sending a confirmation email acts as a "paper trail." It helps the user remember they made the change (so they don't lock themselves out later) and alerts them immediately if someone else changed their password without permission.
• Admin-initiated password resets: If an admin resets a user's password, this notification tells the user their account has been modified. It encourages them to log in right away, set a new password they trust, and verify no other unauthorized changes were made.
• System-enforced password resets: If your platform requires periodic password resets (for compliance reasons) or forces a reset after a security breach, the notification ensures the user is aware of the change and can take action to secure their account promptly.

At the end of the day, these notifications all boil down to transparency and security—keeping users in the loop about changes to their most sensitive account credential.

内容的提问来源于stack exchange，提问作者Daniel