Skip to main content
All failure scenarios
Protection example
ACCESS CRITICAL
8 checks

Don't discover login is broken from your customers.

A deploy works for developers but locks real users out.

Protect a flow like thisHow Endia verifies flows

The problem

A deploy works for developers but locks real users out.

When this breaks after deploy, the cost shows up as lost revenue, locked-out users, support load, or silent data mistakes — not as a red unit test in CI.

What can break

  • valid login rejected
  • redirect loop after sign-in
  • session immediately expires
  • logged-out user reaches protected UI
  • OAuth entry path fails
  • password reset entry breaks

The critical flow

  1. 1register
  2. 2login
  3. 3logout
  4. 4session persistence
  5. 5password-reset entry
  6. 6OAuth entry (safe demo)

What Endia checks

  • Registration succeeds

    New account reaches a signed-in or verify-next state

  • Valid login accepted

    Correct credentials reach authenticated UI

  • Invalid login denied

    Wrong credentials stay unauthenticated with an error

  • Session persists

    Refresh or revisit still shows authenticated state

  • Logout clears access

    Protected route is denied after logout

  • Anonymous cannot open protected UI

    Logged-out visitor is redirected or blocked

  • Password reset entry works

    Reset entry form is reachable and accepts a valid email shape

  • OAuth entry reachable

    OAuth start control is present (demo does not complete real IdP)

What a pass means
SAFE TO MERGE — register/login/logout and protected-route denial still behave as recorded.
What a failure looks like
REGRESSION DETECTED — e.g. valid login rejected, redirect loop, or protected UI reachable while logged out.

What evidence you get

Screenshots of the failing auth state, step trace, console errors if present, and the release check result.

screenshots
step trace
release check
console errors

How it fits the Vercel preview gate

Auth regressions on previews become PR blockers before customers hit production login.

Try the protected flow (controlled fixture)

Neutral demonstration fixture — not a customer app, not live production data. Walk the flow Endia would record and replay on a Vercel preview.

Neutral auth session
Demonstration data

No real identity provider. Password never leaves the browser demo.

Known limitations

  • Fixture is a controlled session demo — no real password store or IdP.
  • OAuth is entry-path only; no live provider redirect or token exchange.
  • Does not demonstrate auth bypass techniques.

Protect a flow like this

Sign in to record your critical journey and run it on every Vercel preview.

Protect a flow like this