Passwordless login looks simple from the UI, but the audit trail behind it can get risky fast. I have seen teams protect their token table carefully, then leak the same access path into logs, traces, and support dashboards because the full magic link felt "temporary enough." It is not. If a magic link can still sign a user in, it should be treated like a credential. That means your observability stack, help desk exports, and debug tooling should never become an easier place to find it than th...