Email links and Pushover codes expire after 15 minutes. Resetting a password does not change account permissions.
At least 6 characters: upper/lowercase and a number or symbol; no character three times consecutively.