LogicTrail
  • Trails
  • Check my app
  • Pricing
  • Sign in
  1. Trails
  2. /
  3. Accounts and privacy

Accounts and privacy

Sign-in screens look simple, and AI tools build them fast. The dangerous parts are the edges: how many guesses a login code allows, how long a reset link lives, who can change the email, what 'no account found' gives away, what 'delete my account' really deletes, and where your customers' words go when you add AI. This trail covers each one.

Scenarios
6
Total time
22 minutes
Free to try
The first one

6 scenarios on this trail

  1. Next up · Free · 4 minSix digits, endless guessesYour app signs people in with a 6-digit code sent by email. A security researcher writes: 'I got into your demo account without access to its inbox.'
  2. Stop 2 · Pro · 4 minThe immortal reset linkA customer forwarded an old 'reset your password' email to a colleague by mistake. Months later, that link still lets anyone set a new password.
  3. Stop 3 · Pro · 3 minThe quiet email changeSomeone used a customer's unlocked laptop for two minutes, changed the account's email to their own, then reset the password. The customer is locked out of their own account.
  4. Stop 4 · Pro · 3 minNo account with that emailYour 'forgot password' page helpfully says 'No account with that email'. A competitor uses it to check which of their clients are using your app.
  5. Stop 5 · Pro · 4 minDeleted, but still thereA user tapped 'Delete my account' and saw a goodbye screen. A month later they ask why you emailed them a newsletter, and why their photos still open from a saved link.
  6. Stop 6 · Pro · 4 minCustomer data in the promptYour new AI support summary sends every support conversation, with names, emails and order details, to an AI provider. A customer asks where their data goes.

Other trails

  • Who may see what

    Sign-in, permissions, and the leaks AI-built apps ship most often.

  • The life of a click

    Follow one button press from the browser to the database and back.

  • Money and secrets

    Keys, payments, webhooks, and reading what your AI changed.

  • Data you can lose

    Agents that reset production, backups that are a day old, rollbacks that break.

  • Bills that explode

    Open AI endpoints, bot traffic, fake signups and functions that loop forever.

  • Working with your AI agent

    Dangerous commands, fix loops, deleted tests, prompt injection and invented packages.

  • Launch day

    Emails that never arrive, sign-in errors, timeouts, stale prices and connection limits.

  • Keeping it running

    Silent errors, empty AI credits, expired domains, leaky logs, risky updates and retired models.

  • Don't trust the browser

    Prices, webhooks, uploads, form limits and coupons: what visitors can change, and what your server must decide.

  • Teams and sharing

    Removed members who keep access, invites anyone can use, exports that leak other customers, guessable share links.

  • Into the app stores

    Keys inside phone apps, store rejections, review sign-ins, old versions, deep links and over-the-air updates.

Sign in
  1. Next up · Free · 4 minSix digits, endless guessesYour app signs people in with a 6-digit code sent by email. A security researcher writes: 'I got into your demo account without access to its inbox.'
  2. Stop 2 · Pro · 4 minThe immortal reset linkA customer forwarded an old 'reset your password' email to a colleague by mistake. Months later, that link still lets anyone set a new password.
  3. Stop 3 · Pro · 3 minThe quiet email changeSomeone used a customer's unlocked laptop for two minutes, changed the account's email to their own, then reset the password. The customer is locked out of their own account.
  4. Stop 4 · Pro · 3 minNo account with that emailYour 'forgot password' page helpfully says 'No account with that email'. A competitor uses it to check which of their clients are using your app.
  5. Stop 5 · Pro · 4 minDeleted, but still thereA user tapped 'Delete my account' and saw a goodbye screen. A month later they ask why you emailed them a newsletter, and why their photos still open from a saved link.
  6. Stop 6 · Pro · 4 minCustomer data in the promptYour new AI support summary sends every support conversation, with names, emails and order details, to an AI provider. A customer asks where their data goes.