Pen test M1: the sign-in page reveals which email domains use single sign-on

From the penetration test report received on Friday, 23 October (Confluence SEC › Penetration test 2026): no critical or high findings, three medium, four low. This is M1, medium.

Typing an email whose domain uses single sign-on sends the person straight to their company's sign-in. A stranger can use that to find out which companies are our customers.

Options: ask for the depot first, or show the same next step for every email and only redirect after a second step. Due 20 November.