Test accounts¶
Test accounts let SQUR sign in and test the logged-in app. Add them under Who do we sign in as? during setup, or on the app's Settings tab. Add one account per role (for example admin and user) so SQUR can test access between roles.
Each account has:
- Role name: what the account is, for example "admin".
- How the account signs in (see below) with its username and password.
- Login URL (optional): where to sign in.
- Verification URL (optional): a URL that is only reachable when signed in, so SQUR can confirm the login worked.
- Notes (optional).
If the app is public and has no login, mark it as public instead. Without a test account, SQUR only tests the public surface.
Sign-in types¶
Choose how the account signs in:
| Type | Use it when |
|---|---|
| Username & password | The app has a normal login form or token login. |
| Password + email code | The app sends a one-time code by email after the password (2FA). SQUR provides an inbox for the code. |
| Email one-time code | Passwordless: the app emails a login code instead of a password. |
| Password + authenticator app | The app asks for a code from an authenticator app. Paste the setup key or the otpauth:// link shown when you enable 2FA. SQUR computes each code from it. It is stored like a password and never shown again. |
SQUR works out the technical details of the login itself, including form logins, JWT and bearer tokens, and OAuth2 or OIDC login through an external provider such as Google, Auth0 or Entra.
Not supported: SAML single sign-on, hardware security keys and passkeys (FIDO), and push-based MFA. Provide a role that does not need these, or a token, so testing can proceed.
Guidance¶
- Create dedicated test accounts with minimal personal data.
- Do not rotate credentials during the pentest. Revoke them when testing is complete, but keep them working if you plan to re-test.