This question already has an answer here:
When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name enumeration. So instead of showing:
Account with email "firstname.lastname@example.org" not found.
display a ambiguous message like:
Please check your email for instructions on how to reset your password.
regardless of whether an account was found or not.
Is this overkill or a good practice?