VulnerabilityHeuristic5 checks
Authentication Flow Scanner
Test your login, signup, and password reset flows for common security weaknesses.
How this scan works
- Locate login/signup/reset forms by common path and field heuristics
- Check the form is served over HTTPS and posts to HTTPS
- Check the password field's type="password" and autocomplete hints
- Check for a visible rate-limit signal (429, Retry-After) after repeated safe probes
- Check for generic vs. account-enumerating error messages where testable
