Backend test page

Milestone 2. Calls /graphql and shows the raw response under each button. Use only demo addresses: any address at @example.com, for example [email protected]. The demo sites (Demo Site 1 to 5) are made up.

1. Scan with no code
Anyone can scan an email. The session token that comes back sees every Finding blurred: no site name and no data. It fills in the session token for step 4. 

    


    

      2. Request a code
      
      
For debugging only: on development and staging (APP_ENV), the response shows
        the code for a demo address and this page fills it in. No email is sent. A real address
        always gets its code by email, and production never returns a code.
      

    


    

      3. Verify the code
      
      
      
Replaces the session token in step 4 with a verified one. Free tier: 3 Findings in full,
        the rest blurred. A record that lists the email is confirmed; Demo Site 5 lists only a
        phone, so it stays discovered.
      

    


    

      4. Findings
      
      
      
      
Scan again and Not me need a verified session. Not me marks one
        Finding, and a new scan keeps the mark.