An application uses a 'forgot username' feature that reveals whether an email is registered: 'If this email is registered, you'll receive a username.' What OWASP vulnerability is this?

• A.User enumeration - the application confirms whether an email address is registered, helping attackers identify valid accounts for targeted attacks
• B.Insecure Design - the recovery workflow sends usernames by email, exposing them to anyone who reads the message in transit or in a mailbox of the account owner
• C.Broken authentication - the application accepts a username without a password in the recovery flow, letting attackers log in with any registered email address from the web form
• D.Information leak - the message names the recovery method, helping attackers pick a channel to target