Feature 3 — prevents password re-use across SaaS apps (even without SSO). Detects the SAME password submitted on different app domains.
PASS 0 · FAIL 0 / 0
How this works: each tile opens a different SaaS app (its own *.localhost domain) and
auto-submits a login. BDR sends only a salted hash (never the password). When the same hash
appears on a 2nd app, a credential-reuse incident fires.
Click the steps IN ORDER (1 → 5). Reuse is MEDIUM → it logs DETECTION [medium] credential-reuse …
and lands on the dashboard (no block page — it's a hygiene warning, not a block).
⚠️ This feature remembers across runs (persisted in the extension). For a clean first-run where step 1
is silent, reload the extension before testing. On a re-run, step 1 may already show reuse — that's expected.