QA Exercise 2

1. Request a reset: enter an email and click Send reset link. Try both a valid email (test@example.com) and an unregistered email.
2. Open the mock email: click the reset link to load the reset form.
3. Reset the password: try weak and mismatched passwords to see the behavior.
4. Speak your report: state the Title, Steps to Reproduce, Expected vs Actual, and your Severity/Priority with a recommendation.

• password reset flow — the end-to-end process of recovering account access via email link.
• token — a one-time unique code in the reset link that authorizes the password change.
• input validation — checks that user inputs meet rules (format, length, strength).
• authentication — confirming identity (e.g., via token).
• authorization — confirming permissions after identity is verified.
• weak password — a password that is easy to guess or too short.
• mismatch — when password and confirm password are not the same.
• severity — impact of a bug on users/systems (e.g., critical, major, minor).
• priority — urgency for fixing the bug (e.g., P0, P1, P2).
• negative test — using invalid inputs to make sure the system rejects them safely.
• edge case — an unusual condition that can expose defects.

• send a reset link / receive a tokenized email
• validate the token / reject invalid tokens
• enforce password strength / prevent weak passwords
• compare password fields / block mismatches
• log a critical bug / assign P0 priority
• verify the fix / retest after a patch

• run into (a bug) — encounter unexpectedly: “We ran into a token validation issue.”
• lock down (security) — make stricter: “We need to lock down the reset logic.”
• track down — locate the root cause: “We tracked down the inverted check.”
• rule out — eliminate possibilities: “We ruled out email delivery as the cause.”
• iron out the bugs — fix remaining problems before release.

Bug title: Password reset accepts invalid emails and inverts token validation.

Steps to reproduce: First, request a reset using an unregistered email. Next, open the mock email and click the reset link. Then, enter a weak password and a different confirm value. Finally, submit the form.

Expected result: The system should reject unregistered emails, validate the token correctly, and block weak or mismatched passwords.

Actual result: The system sends a reset link to unregistered emails, accepts an invalid token but rejects the valid one, and allows weak or mismatched passwords.

Severity / Priority: Critical severity, P0 priority — this undermines account security and must be fixed immediately.

Spoken delivery:
“I ran into multiple critical issues in the password reset flow. The app sends a reset link even for unregistered emails, the token validation is inverted, and weak or mismatched passwords are accepted. I expected strict validation at each step. I’m logging this as a blocker with P0 priority and recommend locking down token checks, enforcing password strength, and rejecting unregistered emails before sending reset links. We should verify the fix with negative tests and a small regression suite.”