One reset link. Three logins. Zero alerts.

A password reset link still worked 31 hours after the password had been changed.

The token had an expiry. It did not have a use count. Nothing marked it as spent, so it stayed valid for its full window — after the reset, after the new password, after the user had moved on.

We replayed the link three times from a clean session. Logged in three times. No alert fired, because from the auth service's point of view nothing unusual happened.

This is the shape of most auth bugs we find. Not a broken check — a missing one.

The expiry test passed. There was no test for "what happens the second time," because nobody writes that test until someone shows them the replay.

We go after the assumption, not the checklist.

Break it here. Not in prod.