Skip to content

#164 · Email-Based Authentication: Cover Logins Behind Email OTPs

Availability: General Availability

Many apps send a one-time code or a magic link by email at sign-in. Until now, that single step was enough to keep an authenticated DAST scan stuck at the login page. Escape now provisions managed scan email addresses the scanner reads on its own, so the rest of your application finally becomes testable end-to-end.

What's New

  • Managed scan inboxes: Escape provisions email addresses under @scan.escape.tech tied to your organization, so you don't have to share a real inbox with the scanner.
  • Email OTP support: the scanner waits for the email, extracts the verification code, and types it into the login form without manual help.
  • Magic link support: when the app sends a clickable sign-in link, the scanner follows it the way a real user would.
  • Works with the Agentic Browser: plain-language instructions are enough, and they're even optional. The AI browser detects the email step on its own.

Why It Matters

Email-gated logins are everywhere: SaaS portals, internal admin consoles, and any flow built around passwordless sign-in. Without managed inboxes, AppSec teams either kept these apps out of scope or fell back on test accounts with static codes, leaving real authenticated paths untested. Now that Escape reads the inbox for you, you don't lose coverage every time an app sends a code by email, and authenticated business-logic findings surface where they actually hide: behind the login.

How to Get Started

  • Pick a scan email address: <alias>.<your-org-id-first-segment>@scan.escape.tech. You'll find your organization ID on the Organization general settings page.
  • Reference it as the username in your authentication preset. With the Agentic Browser, plain-language instructions handle the rest. With Browser Actions, use fill_email_totp for codes or click_mail_magic_link for magic links.

Learn More

Questions?

Have a question? Reach out on your dedicated support channel (Slack, Microsoft Teams, or whichever channel we've set up with your team), or email us at support@escape.tech.