Account takeover hunter
Hunts and validates account takeover paths across nine primitives and chains, including password reset flaws, email change without re-auth, OAuth link CSRF, MFA bypass, session fixation, JWT manipulation, password change without step-up, social recovery abuse,