SaaS app logins for testing password re-use across apps. Extension ON, click a tile (auto-signs-in), watch BDR.
Each tile is a different SaaS app on its own *.localhost domain. BDR sends only a salted hash.
Sign in to 2+ apps in the same group (same password) → credential-reuse fires (MEDIUM, no block page).
Prefer the checklist view for the ordered flow + PASS/FAIL.