3 · Credential-reuse — Site B MEDIUM

This is a different site (host 127.0.0.1 ≠ localhost). Submit the same password you used on Site A → credential-reuse fires and records an incident.

Submitted. Expected console: [BDR] DETECTION [medium] credential-reuse: Password reused … · Dashboard: bdr:credential-reuse incident.