User enumeration that could be avoided on email change

Description Currently, when changing an email address via Supabase Auth, it’s possible to infer whether a given email is already registered in the application. When attempting to change to an email that already exists, Supabase returns the following: This behavior allows for user enumeration, which is typically avoided elsewhere in the Supabase Auth flows. Suggested improvement I propose a more privacy-preserving flow: 1. Send a confirmation link to the current email address. 2. Attempt to send a confirmation link to the new email address: • If the new email is not already registered, proceed as usual. • If the new email is already in use send the error to the new email address (or even, not send a thing) This would align with the rest of Supabase’s approach to minimizing user enumeration vectors. Notes • I understand from the bug bounty rules of engagement that user enumeration is currently out-of-scope. • However, I believe this may still warrant conside…