This page demonstrates intentionally insecure IAM design patterns.
This login form uses hard-coded credentials, lacks MFA, and generates a predictable session token.
This system assigns roles without validation and never removes old roles — causing privilege creep and orphaned access.
The audit log has: - No timestamps - No user verification - No integrity - Spoofable entries