Both logins below are rendered inside iframes — the classic bypass where a top-frame-only scanner never sees the credential form. With v0.9.97, the extension now catches both. Watch the /bdr board.
The login is loaded from secure-login-paypal.192-168-1-11.nip.io (a phishing-style host, seeded in the lake). The all-frames sensor reports the frame's host → judged as known-bad → framed-credential detection.
The same login loaded same-origin from localhost. collectLogin() now scans it too — but localhost isn't a brand/known-bad, so it correctly stays silent (no false positive).