Negative controls.
A plain login (no brand cue, same-origin), a clean QR, and a benign link. The BDR service-worker console should stay
quiet
— no detections, no incidents.
Username
Password
Sign in
Clean QR (encodes google.com)
Benign link:
http://example.com
