🧪 VIYUH BDR TEST — SAFE LOCAL SIMULATION (not a real site, nothing is sent anywhere)

This page pretends to be: a guided test bench wrapping two fake SaaS logins — App A “Acme Cloud” and App B “Globex Portal”.

The trick: password reuse — typing the SAME password on two different apps. BDR flags it so users pick unique passwords.

✅ With VIYUH BDR ON you SHOULD see: nothing on App A (first use is fine), then a reuse warning BANNER / card on App B (top-right) once you submit the SAME password there.

👉 Mark PASS if the banner appeared on App B. Mark FAIL if you reused the password and no banner showed.

⚠️ TYPE the password by hand on BOTH apps — do NOT use saved-password autofill. Autofill stores a different password per site, so the hashes won’t match and the test won’t fire. The two must be identical.

Guided test: the same password on two apps → reuse warning

Follow steps 1 → 2 → 3 below. The two fake logins are embedded so you can do the whole flow on one screen. If a banner doesn’t appear inside a frame, click “open in its own tab” and repeat there.

1

App A — Acme Cloud

In the LEFT app, type a password (e.g. Hunter2!) and click Sign in. BDR stays silent — first use is fine.

2

App B — Globex Portal

In the RIGHT app, type the EXACT SAME password Hunter2! and click Log in.

✓

Expected result

A reuse warning card appears on App B saying the password was seen on two sites. PASS if you see it.

App A · Acme Cloud FIRST

Opens on acme.localhost — a different site from App B.

▶ Open App A (Acme) ↗

Type Hunter2! → Sign in. BDR stays silent (first use — that's correct).

App B · Globex Portal SECOND

Opens on globex.localhost — a different site from App A.

▶ Open App B (Globex) ↗

Type the SAME Hunter2! → Log in → a reuse banner appears.

⚠️ Why two subdomains? Reuse only fires across different sites. The buttons above open App A on acme.localhost and App B on globex.localhost — two distinct sites that both resolve to your own machine, so the same password on both = genuine cross-site reuse. If you open both apps on plain localhost, BDR correctly sees ONE site and stays silent (not a failure).
🔒 Privacy by design: BDR never sends your password. It computes a salted hash (one-way fingerprint) on the page and only compares hashes across sites — so it can tell “same password reused” without ever seeing or storing the password.