Login Flow (login-flow)

Summary

Login page discovery, form analysis, HTTPS, invalid credentials, CSRF hints.

Classification

• Category: ECOMMERCE
• Plugin id: login-flow
• Version: 1.0.0
• Target types: WEBSHOP
• Weight class: MEDIUM
• Risk level: not set on plugin object
• Browser required: Yes (Playwright)
• Tier / group: Tier 3 — E-commerce / flows (Playwright)

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 4 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
loginUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
stepTimeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• _secrets — optional login credentials for authenticated checks when applicable.

What it does

• Runs as part of the worker test execution pipeline; results become Run rows and may create Finding records.
• Login page discovery, form analysis, HTTPS, invalid credentials, CSRF hints.
• For finding titles, metrics, and artifacts specific to this plugin, refer to the implementation linked below.

Source

packages/test-plugins/src/plugins/login-flow.ts