FLA 2026 · KARACHI

Future Leaders Award — User + Guest-of-Honor QA

Round 8 — visitor registration + GoH signup · fresh mail.tm disposables · clean CDP session

https://fla.events.jugaar.ai/

Audit date: 14 Sep 2026 (R8) Auditor: Hermes / X2 App version: SERVER4SALE v5.10.0 Event slug: fla-2026-karachi Mode: Chrome 152 (CDP port 9336) · 2x mail.tm disposables · 90 s polls

🟢 R8 — visitor + GoH signup flows work end-to-end with fresh disposables

✅ R8 finding — both signup flows are healthy on v5.10.0

Both POST /register/visitor and POST /guest-of-honor accept a fresh disposable email, return to a "completed" page, send a Mailjet email to the actual submitted address, and the verify link authenticates correctly.

2/2

Flows passed end-to-end

2/2

Mailjet deliveries

2/2

Verify clicks authenticated

Errors

v5.10.0

App version

Disposables used

1.Visitor (user) registration flow

Step	Action	Result
1	GET `/register/visitor` + DOM-fill + submit	HTTP 302 → `/register/done?id=288` · title "Registration complete"
2	Poll `r8vis9c5ba775@uberip.com` (mail.tm)	✓ Email arrived within 30 s · "Verify your email — Event"
3	Click `/verify-email?token=a0cc4b1ec18...`	HTTP 200 · title "Email verified" · "Thanks R8 Visitor — your email is verified."

Visitor email content (proof of correct delivery)

From:    awards@server4sale.com.pk
To:      r8vis9c5ba775@uberip.com  ← actual submitted address
Subject: Verify your email — Event

Hi R8 Visitor,

Please verify your email:
https://fla.events.jugaar.ai/verify-email?token=a0cc4b1ec18ef074789379e41f5857bf6081af0b0f1672e2

— Event

2.Guest-of-Honor signup flow

Step	Action	Result
1	GET `/guest-of-honor?event=fla-2026-karachi` + DOM-fill email-only + submit	HTTP 200 · "Check your email" page (step 1 verified, awaiting step 2 magic link)
2	Poll `r8goh703905b4@uberip.com` (mail.tm)	✓ Email arrived within 60 s · "Your login link — Future Leaders Award"
3	Click `/login/magic?token=766668a65e93532c...`	HTTP 200 · "My dashboard · Hello, there 👋 · Role: goh" — fully authenticated
4	GoH dashboard form fields visible	`_csrf, event_id, slot_date, start_time, end_time, note` (time-slot offering), `linkedin, social_x, social_instagram, social_facebook` (profile links), `confirm` (delete-safety text field)

GoH email content

From:    awards@server4sale.com.pk
To:      r8goh703905b4@uberip.com  ← actual submitted address
Subject: Your login link — Future Leaders Award

Hi ,

Sign in with this one-time link (valid 15 minutes):
https://fla.events.jugaar.ai/login/magic?token=766668a65e93532c9aede2ab9a1f75334aaa50dedcce026a

— Future Leaders Award

3.GoH dashboard (newly-discovered surface)

R8 logged in as a GoH and discovered a substantial new dashboard surface:

Hello, there 👋 — Role: goh
"Register for an event" + "Apply for an award" CTAs
⏰ My availability & requested slots + ➕ Offer a time slot — form has slot_date, start_time, end_time, note
🖼 My media — "Photos or video links — shown on your vote page & the event wall after staff review"
Notifications panel + Messages

This surface was NOT present in R1–R7 — it's a v5.10.0 addition. Suggest dev team confirm completeness (placeholder empty-state across all 4 panels).

4.Cumulative bug status across all 8 rounds

#	Bug	Original finding (round)	Status as of R8
1	Mailer recipient substitution	R2	REFUTED (R5) — still refuted R8
2	/nominate 5 000-char → 500	R2	FIXED in v5.9.0 (R4)
2b	/nominate success path regression	R3	FIXED in v5.9.0 (R4)
3	No rate-limit on /login/magic	R2	Still open (not re-tested R5-R8)
4	/nominate invalid email silently accepted	R2	Still open (not re-tested R5-R8)
5	422 vs 200 enumeration leak	R2	Still open (not re-tested)
6.A	Verify-cookie but no vote count increment	R6 (false alarm)	WORKS in v5.10.0 (R7) — was UX bug, dev team fixed
6.B	IP rate-limit /voter-form/.../submit	R6	Not re-tested in R8 (single submission)
7a	Verify URL → /nominees (not /v/<hash>)	R7	Still open (NOT fixed in v5.10.0)
7b	Cast-vote reason not enforced client-side	R7	Still open
7c	Step 1/4 URL collision	R7	Still open
8	Visitor registration email body shows "Hi X2 Test" placeholder when name missing	R8 observation	See observation #1 below

⚠ R8 observations on v5.10.0 (UX polish)

Visitor verify-email body has a placeholder bug. Body says "Hi ," (empty name) instead of using the submitted name. The AWARD magic-link mail and VOTER verify-mail have similar bodies — they all hardcode "Hi " with no name interpolation. Fix the template; this is a tiny copyfix the dev team can land in 5 minutes.
Visitor registration has no rate-limit countdown. The page shows an "id=288" registration record on success but no estimated review time or notification SLA. Visitors won't know when to expect the "Approved" email. Nice-to-have: add a banner "Reviews take ~24 h — you'll get an email at the address you provided."
GoH magic-link body also has empty-name "Hi ,". Same template bug as visitor. Fix in same change.
/guest-of-honor step 1 is email-only (no name/title/biography capture). After magic-link, the user lands on a dashboard with a separate time-slot offering form. That's fine UX but the steps are not labeled — a "Step 1 of 2: Verify email · Step 2 of 2: Fill profile & offer slot" hint would clarify why the dashboard is so empty for first-time GoH users.

5.Recommended Next Steps (delta from R8)

Fix the "Hi ," template bug in all verify/login emails. Trivial template change — interpolate {{ $name }} from the form data. Currently the visitor email body says "Hi ," instead of "Hi R8 Visitor".
Tighten v5.10.0 rate-limit surface. Add Laravel throttle middleware to /login/magic and /voter-form/.../submit. Confirmed earlier in R5 (200 × 7 on /login) and R6 (?error=rate on voter form).
Add GoH profile-completion steps to the post-magic dashboard — current state has 4 empty-state panels.
Update /register/visitor success page. Add review-time SLAs so visitors know when to expect the approval email.
Re-test bug 6.A path-coverage. Now that v5.10.0 works end-to-end, write a CI test that drives step 1→2→3→4 and asserts the vote count increments — would catch any future regression on this critical path.

6.R8 Probe Log

Visitor flow — disposable r8vis9c5ba775@uberip.com

GET /register/visitor
POST /register/visitor (DOM-submit)
  → 302 /register/done?id=288&t=udNvjUmd73eZdOB7pQujfx2rOCf
  → title "Registration complete"
Poll r8vis9c5ba775@uberip.com 90s
  ✓ subject: "Verify your email — Event"
  ✓ to:      r8vis9c5ba775@uberip.com  ← actual submitted
  ✓ body:    "Hi R8 Visitor, Please verify your email: https://fla.events.jugaar.ai/verify-email?token=a0cc..."

GET /verify-email?token=a0cc4b1ec18...
  → title: "Email verified"
  → body:  "✅ Email verified · Thanks R8 Visitor — your email is verified. → Go to dashboard"

GoH flow — disposable r8goh703905b4@uberip.com

GET /guest-of-honor?event=fla-2026-karachi
POST /guest-of-honor (DOM-submit, email-only)
  → 200 "Check your email" page

Poll r8goh703905b4@uberip.com 90s
  ✓ subject: "Your login link — Future Leaders Award"
  ✓ to:      r8goh703905b4@uberip.com  ← actual submitted
  ✓ body:    "Hi , Sign in with this one-time link (valid 15 minutes):
             https://fla.events.jugaar.ai/login/magic?token=766668a65e93532c..."

GET /login/magic?token=766668a65e93532c...
  → title: "My dashboard"
  → body:  "Hello, there 👋 · Role: goh · No registrations yet"
  → form fields: _csrf, event_id, slot_date, start_time, end_time, note,
                 linkedin, social_x, social_instagram, social_facebook,
                 confirm (delete-safety)