Sign in

Magic link

Enter your email and we'll send a one-time sign-in link. In this lab the link/token is returned directly by POST /auth/magic-link; redeem it at /auth/redeem?token=… for a JWT.

Password (legacy fallback)

Seeded members (lab)

• user@hive.example — attacker identity (role: user)
• victim@hive.example — victim (owns the account/doc the IDOR findings target)
• mod@hive.example — moderator (noise)
• admin@hive.example — admin (noise)

For convenience the lab seeds opaque session tokens (e.g. Authorization: Bearer lab-sess-user-0051) so you can skip the redeem step.