attest Test accounts
Use scoped credentials with a preview.
Attest can use configured username/email and password profiles for supported form-login scenarios. An administrator scopes profiles to repositories and permitted preview origins. The trusted backend injects credentials through a constrained operation; the model is not given the secret value.
The preview application can read credentials entered into its own page. Use disposable, least-privilege test accounts and synthetic, resettable data. Never use production credentials. Fork PR credentials are denied by default.
The current browser subset does not support arbitrary enterprise SSO, CAPTCHA, MFA, WebAuthn or email OTP. Cross-origin sign-in is outside the current single-origin browser boundary. A blocked sign-in should be treated as inconclusive, not a pass.
Screenshots can be withheld after credential use or signed navigation. See security and privacy and results and evidence.