Martin Roest

Can this be updated? JSON has a security vulnerability See: https://github.com/advisories/GHSA-f4c9-cqv8-9v98

Same issue here...

> Hi @mroest ! > > So the idea being is that you can set some flag that would automatically set it to `user.email` instead of `user.username`? Yes, absolutely! And...

If the cognito user pool is configured to use email as username, the username becomes a UUID string. That UUID string is then displayed when you setup TOTP and add...