Tests made
One line per test run, in order. All runs used test sites and test accounts
of our own, one browser tab at a time, with at least 3.5 seconds between
attempts (faster gets a rate limit, 429000, which is not an RBA answer).
The outcome column is the short version; the Findings page
puts them together.
| Date | Tenant | What was done | Outcome |
|---|---|---|---|
| 2026-08-24 | STG | Per-account failed-login counter at 3, raw logins without captcha token | The third failure already answered 401020; wrong passwords count |
| 2026-08-24 | STG | Flagged account, login through the screen-set, several runs | No box without a fresh failure; box when a failure preceded the login by seconds (2 of 2) |
| 2026-08-24 | STG | Per-IP counter at 3, non-existent login names | 401020 on the first attempt from the flagged address |
| 2026-08-26 | STG | ATO on vs off, three clean logins each | Scores 0.3 with ATO on, 0 with it off; same latency |
| 2026-08-26 | STG | New device and network for a known account, ATO on | Score stayed at 0.3 |
| 2026-08-26 | STG | Burst of five failures then a login, ATO on | High-risk rule fired at 0.8, box shown, address flagged |
| 2026-08-26 | STG | Flagged account from a clean phone, with and without a fresh failure from the desktop | Box only with the fresh failure: the effect is server-side |
| 2026-08-27 | STG | Both flags re-probed after the night | Both expired, between 2.5 and 13 hours |
| 2026-08-27 | STG | ATO matrix: 2, then 5, then 7 failures; other account from the same address; attacked account from another network | 2 failures no rule; 7 in two minutes fired it; neighbour account challenged; attacked account elsewhere not |
| 2026-08-27 | STG | Five failures across five different login names, clean address, ATO on | Fifth answered 401020: the pattern counts across accounts |
| 2026-08-27 | STG | Four failures, six-minute pause, fifth failure | Still fired: the window is longer than six minutes |
| 2026-08-28 | PROD | Read of the live RBA policy and security policies through the API, read-only | Rules inventoried; score rules at 0.8; captcha-on-registration off |
| 2026-10-07 to 09 | PPP | Akamai in the path: DNS, cookies on the CDC responses, client IP as recorded by CDC, with the integration keys on and off | Route and cookies differ from production; keys changed nothing visible; the recorded IP was the edge |
| 2026-10-08 to 09 | PPP | Akamai Account Protector on and off in CDC, manual logins on two sibling sites | Fixed high scores with it on, also where Akamai is not in the path; raised with the vendor |
| 2026-10-14 | PPP | Re-read of the integration state on parent and child | Child override saved once the parent had a value |
| 2026-10-26 | PPP | Lockout rule on this test site: three failures, then one attempt after 12 s and after 25 s of silence | Third failure 403120; still locked at 12 s, free at 25 s: the counter window rules, not the duration |
| 2026-11-05 | PPP, STG | This page: site selector and configuration checks on both tenants | Both render; captcha keys present on both |