Back to Workflows

Model registration, verification, recovery, MFA, session refresh, logout, and account deletion as explicit states. Look for state transitions that grant more access than the prior state permits.

Create a state table from normal flows, then replay one permitted transition at a time with controlled accounts; compare issued tokens, reachable routes, and server-side state.