🧪 VIYUH BDR TEST — SAFE LOCAL SIMULATION — ✅ FALSE-POSITIVE GUARD (BDR should stay SILENT)
This page pretends to be:
A legitimate SaaS login (Contoso Cloud) that posts to its own backend
Why it must NOT fire:
The login DOES post off to another host — but that host is the app's OWN auth backend, NOT a real identity provider. AiTM only flags credentials sent to a known IdP (login.microsoftonline.com, accounts.google.com, paypal.com, okta.com, …). A normal app posting to its own API is not Adversary-in-the-Middle, so flagging it would be a false positive.
✅ With VIYUH BDR ON you SHOULD see:
NOTHING — no block, no warning. (If it blocks, that's a FALSE POSITIVE → FAIL.)
👉 Mark PASS if BDR stayed silent.