Five of the eighteen checks, running against a simulated API. Nothing is installed and nothing leaves your browser.
Do this. Sign in with an address that does not exist, then a real one with a wrong password. Compare the wording, the status, and the time.
Two different messages turn a login form into a membership oracle: submit ten thousand addresses, learn which belong to your customers.
Do this. Sign in successfully and read every field of the response, not just the one you wanted.
You only find a PIN in a response by reading fields you did not ask for.
Do this. Sign in twice, so two sessions exist. Change the password using the first. Then use the second token.
This is the control that evicts an attacker. A user who suspects compromise changes their password — the one thing everybody knows to do. If it does not kill the other session, that action is ceremonial and they stop looking.
Do this. Capture the raw token. Log out. Send the same token again — not through the interface, directly.
Testing logout through the interface proves nothing; the interface threw its copy away. The question is whether the server did.
Do this. Fetch your own record, note the identifier, change it to someone else's, send it again.
Broken object-level authorization is the most commonly reported serious defect in web APIs. It survives because the interface never offers you the option.
Password policy enforced server-side · unverified accounts blocked · lockout and counter reset · exact password comparison · reset token expiry · single-use reset tokens · reset token delivery · MFA rate limiting · MFA code reuse · MFA bypass · session expiry · session rotation on login · admin endpoint access.
All eighteen, with steps and expected results, are in the free checklist.
Get the free checklistThis page runs entirely in your browser. There is no server, no account, no data stored and nothing transmitted. The "API" is simulated in JavaScript so the defects are safe to demonstrate — a genuinely vulnerable application should never be put on the public internet, which is a lesson in itself.